theory CNodeInv_R

lemma invokeCNode_corres:
  "cnodeinv_relation ci ci' \<Longrightarrow>
   corres (dc \<oplus> dc)
     (einvs and simple_sched_action and valid_cnode_inv ci)
     (invs' and sch_act_simple and valid_cnode_inv' ci')
     (invoke_cnode ci) (invokeCNode ci')" apply (simp add: invoke_cnode_def invokeCNode_def) apply (cases ci, simp_all) apply clarsimp apply (rule corres_guard_imp) apply (rule cteInsert_corres) apply simp+ apply (clarsimp simp: invs_def valid_state_def valid_pspace_def
                        elim!: cte_wp_at_cte_at) apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def) apply clarsimp apply (rule corres_guard_imp) apply (erule cteMove_corres) apply (clarsimp simp: cte_wp_at_caps_of_state real_cte_tcb_valid) apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule cteRevoke_corres) apply (rule corres_guard_imp [OF cteDelete_corres]) apply (clarsimp simp: cte_at_typ cap_table_at_typ halted_emptyable) apply simp apply (rename_tac cap1 cap2 p1 p2 p3) apply (elim conjE exE) apply (intro impI conjI) apply simp apply (rule corres_guard_imp) apply (rule_tac F="wellformed_cap cap1 \<and> wellformed_cap cap2"
              in corres_gen_asm) apply (erule (1) cteSwap_corres [OF refl refl], simp+) apply (simp add: invs_def valid_state_def valid_pspace_def
                       real_cte_tcb_valid valid_cap_def2) apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def
                           cte_wp_at_ctes_of weak_derived'_def) apply (simp split del: if_split) apply (rule_tac F = "cte_map p1 \<noteq> cte_map p3" in corres_req) apply clarsimp apply (drule (2) cte_map_inj_eq [OF _ cte_wp_at_cte_at cte_wp_at_cte_at]) apply clarsimp apply clarsimp apply clarsimp apply simp apply simp apply (rule corres_guard_imp) apply (rule corres_split) apply (erule cteMove_corres) apply (erule cteMove_corres) apply wp apply (simp add: cte_wp_at_caps_of_state) apply (wp cap_move_caps_of_state cteMove_cte_wp_at [simplified o_def])+ apply (simp add: real_cte_tcb_valid invs_def valid_state_def valid_pspace_def) apply (elim conjE exE) apply (drule(3) real_cte_weak_derived_not_reply_masterD)+ apply (clarsimp simp: cte_wp_at_caps_of_state
                           ex_cte_cap_to_cnode_always_appropriate_strg
                           cte_wp_at_conj) apply (simp add: cte_wp_at_ctes_of) apply (elim conjE exE) apply (intro impI conjI) apply fastforce apply (fastforce simp: weak_derived'_def) apply simp apply (erule weak_derived_sym') apply clarsimp apply simp apply clarsimp apply simp apply clarsimp apply clarsimp apply (rename_tac prod) apply (simp add: getThreadCallerSlot_def locateSlot_conv objBits_simps) apply (rule corres_guard_imp) apply (rule corres_split[OF getCurThread_corres]) apply (subgoal_tac "thread + 2^cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)") prefer 2 apply (simp add: cte_map_def tcb_cnode_index_def tcbCallerSlot_def cte_level_bits_def objBits_defs) apply (rule corres_split[OF getSlotCap_corres]) apply simp apply (rule_tac P="\<lambda>s. (is_reply_cap cap \<or> cap = cap.NullCap) \<and>
       (is_reply_cap cap \<longrightarrow>
        (einvs and cte_at (threada, tcb_cnode_index 3) and
         cte_wp_at (\<lambda>c. c = cap.NullCap) prod and
         real_cte_at prod and valid_cap cap and
         K ((threada, tcb_cnode_index 3) \<noteq> prod)) s)" and
        P'="\<lambda>s. (isReplyCap rv' \<and> \<not> capReplyMaster rv') \<longrightarrow> (invs' and
         cte_wp_at'
          (\<lambda>c. weak_derived' rv' (cteCap c) \<and>
               cteCap c \<noteq> capability.NullCap)
          (cte_map (threada, tcb_cnode_index 3)) and
         cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod)) s" in corres_inst) apply (case_tac cap, simp_all add: isCap_simps is_cap_simps split: bool.split)[1] apply clarsimp apply (rule corres_guard_imp) apply (rule cteMove_corres) apply (simp add: real_cte_tcb_valid)+ apply (wp get_cap_wp) apply (simp add: getSlotCap_def) apply (wp getCTE_wp)+ apply clarsimp apply (rule conjI) apply (rule tcb_at_cte_at) apply fastforce apply (simp add: tcb_cap_cases_def) apply (clarsimp simp: cte_wp_at_cte_at) apply (rule conjI) apply (frule tcb_at_invs) apply (frule_tac ref="tcb_cnode_index 3" and Q="is_reply_cap or (=) cap.NullCap"
                   in tcb_cap_wp_at) apply (clarsimp split: Structures_A.thread_state.split_asm)+ apply (clarsimp simp: cte_wp_at_def is_cap_simps all_rights_def) apply clarsimp apply (rule conjI, simp add: cte_wp_valid_cap invs_valid_objs) apply (clarsimp simp: cte_wp_at_def is_cap_simps all_rights_def) apply clarsimp apply (rule conjI, fastforce) apply (rule conjI, fastforce) apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps) apply clarsimp apply (case_tac "has_cancel_send_rights x7",
                frule has_cancel_send_rights_ep_cap,
                simp add: is_cap_simps) apply (clarsimp simp: when_def unless_def isCap_simps) apply (rule corres_guard_imp) apply (rule cancelBadgedSends_corres) apply (simp add: valid_cap_def) apply (simp add: valid_cap'_def) apply (clarsimp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. cnodeinv_relation ci ci' \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and valid_cnode_inv ci) (invs' and sch_act_simple and valid_cnode_inv' ci') (invoke_cnode ci) (invokeCNode ci') proof (prove)
goal (1 subgoal):
 1. cnodeinv_relation ci ci' \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and valid_cnode_inv ci) (invs' and sch_act_simple and valid_cnode_inv' ci') (case ci of InsertCall cap src_slot dest_slot \<Rightarrow> without_preemption $ cap_insert cap src_slot dest_slot | MoveCall cap src_slot dest_slot \<Rightarrow> without_preemption $ cap_move cap src_slot dest_slot | RevokeCall dest_slot \<Rightarrow> cap_revoke dest_slot | DeleteCall dest_slot \<Rightarrow> cap_delete dest_slot | RotateCall cap1 cap2 slot1 slot2 slot3 \<Rightarrow> without_preemption $ if slot1 = slot3 then cap_swap cap1 slot1 cap2 slot2 else do cap_move cap2 slot2 slot3;
cap_move cap1 slot1 slot2
od | SaveCall slot \<Rightarrow> without_preemption $ do thread <- gets cur_thread;
src_slot <- return (thread, tcb_cnode_index 3);
cap <- get_cap src_slot;
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap src_slot slot | _ \<Rightarrow> fail
od | CancelBadgedSendsCall (cap.EndpointCap ep b R) \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | CancelBadgedSendsCall _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>x11 x12 x13. \<lbrakk>\<exists>c'. cap_relation x11 c' \<and> ci' = Insert c' (cte_map x12) (cte_map x13); ci = InsertCall x11 x12 x13\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x11 and real_cte_at x12 and real_cte_at x13 and (\<lambda>s. cte_wp_at (is_derived (cdt s) x12 x11) x12 s) and cte_wp_at (\<lambda>c. c = cap.NullCap) x13 and ex_cte_cap_wp_to is_cnode_cap x13 and (\<lambda>y. x12 \<noteq> x13) and (\<lambda>s. \<forall>r\<in>obj_refs x11. \<forall>a b. x13 \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s \<and> \<not> is_zombie x11))) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_insert x11 x12 x13)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 2. \<And>x21 x22 x23. \<lbrakk>\<exists>c'. cap_relation x21 c' \<and> ci' = Move c' (cte_map x22) (cte_map x23); ci = MoveCall x21 x22 x23\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) x23 and cte_wp_at ((\<noteq>) cap.NullCap) x22 and cte_wp_at (weak_derived x21) x22 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) x22 and ex_cte_cap_wp_to is_cnode_cap x23 and real_cte_at x22 and real_cte_at x23)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_move x21 x22 x23)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 3. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 4. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 5. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 6. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>x11 a b aa ba c'. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba))\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap x11 and cap_table_at (length b) a and cap_table_at (length ba) aa and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) x11) (a, b) s) and cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, ba) and ex_cte_cap_wp_to is_cnode_cap (aa, ba) and (\<lambda>y. a = aa \<longrightarrow> b \<noteq> ba) and (\<lambda>s. \<forall>r\<in>obj_refs x11. \<forall>a b. (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s \<and> \<not> is_zombie x11))) (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) c' \<circ> cteCap) (cte_map (a, b)) s) and cte_wp_at' (untyped_derived_eq c' \<circ> cteCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba)) and (\<lambda>s. cte_map (a, b) \<noteq> cte_map (aa, ba)) and ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)))) (cap_insert x11 (a, b) (aa, ba)) (cteInsert c' (cte_map (a, b)) (cte_map (aa, ba)))
 2. \<And>x21 x22 x23. \<lbrakk>\<exists>c'. cap_relation x21 c' \<and> ci' = Move c' (cte_map x22) (cte_map x23); ci = MoveCall x21 x22 x23\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) x23 and cte_wp_at ((\<noteq>) cap.NullCap) x22 and cte_wp_at (weak_derived x21) x22 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) x22 and ex_cte_cap_wp_to is_cnode_cap x23 and real_cte_at x22 and real_cte_at x23)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_move x21 x22 x23)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 3. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 4. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 5. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 6. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (9 subgoals):
 1. \<And>x11 a b aa ba c'. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba))\<rbrakk> \<Longrightarrow> corres dc (?Q16 x11 a b aa ba c') (?Q'16 x11 a b aa ba c') (cap_insert x11 (a, b) (aa, ba)) (cteInsert c' (cte_map (a, b)) (cte_map (aa, ba)))
 2. \<And>x11 a b aa ba c' s. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba)); (einvs and simple_sched_action and (valid_cap x11 and cap_table_at (length b) a and cap_table_at (length ba) aa and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) x11) (a, b) s) and cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, ba) and ex_cte_cap_wp_to is_cnode_cap (aa, ba) and (\<lambda>y. a = aa \<longrightarrow> b \<noteq> ba) and (\<lambda>s. \<forall>r\<in>obj_refs x11. \<forall>a b. (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s \<and> \<not> is_zombie x11))) s\<rbrakk> \<Longrightarrow> ?Q16 x11 a b aa ba c' s
 3. \<And>x11 a b aa ba c' s. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba)); (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) c' \<circ> cteCap) (cte_map (a, b)) s) and cte_wp_at' (untyped_derived_eq c' \<circ> cteCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba)) and (\<lambda>s. cte_map (a, b) \<noteq> cte_map (aa, ba)) and ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)))) s\<rbrakk> \<Longrightarrow> ?Q'16 x11 a b aa ba c' s
 4. \<And>x21 x22 x23. \<lbrakk>\<exists>c'. cap_relation x21 c' \<and> ci' = Move c' (cte_map x22) (cte_map x23); ci = MoveCall x21 x22 x23\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) x23 and cte_wp_at ((\<noteq>) cap.NullCap) x22 and cte_wp_at (weak_derived x21) x22 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) x22 and ex_cte_cap_wp_to is_cnode_cap x23 and real_cte_at x22 and real_cte_at x23)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_move x21 x22 x23)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 5. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 6. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 7. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 8. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 9. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (11 subgoals):
 1. \<And>x11 a b aa ba c'. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba))\<rbrakk> \<Longrightarrow> cap_relation x11 c'
 2. \<And>x11 a b aa ba c'. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba))\<rbrakk> \<Longrightarrow> cte_map (a, b) = cte_map (a, b)
 3. \<And>x11 a b aa ba c'. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba))\<rbrakk> \<Longrightarrow> cte_map (aa, ba) = cte_map (aa, ba)
 4. \<And>x11 a b aa ba c' s. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba)); (einvs and simple_sched_action and (valid_cap x11 and cap_table_at (length b) a and cap_table_at (length ba) aa and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) x11) (a, b) s) and cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, ba) and ex_cte_cap_wp_to is_cnode_cap (aa, ba) and (\<lambda>y. a = aa \<longrightarrow> b \<noteq> ba) and (\<lambda>s. \<forall>r\<in>obj_refs x11. \<forall>a b. (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s \<and> \<not> is_zombie x11))) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> (aa, ba)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, ba) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) x11) (a, b) s)) s
 5. \<And>x11 a b aa ba c' s. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba)); (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) c' \<circ> cteCap) (cte_map (a, b)) s) and cte_wp_at' (untyped_derived_eq c' \<circ> cteCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba)) and (\<lambda>s. cte_map (a, b) \<noteq> cte_map (aa, ba)) and ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)))) s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba))) s
 6. \<And>x21 x22 x23. \<lbrakk>\<exists>c'. cap_relation x21 c' \<and> ci' = Move c' (cte_map x22) (cte_map x23); ci = MoveCall x21 x22 x23\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) x23 and cte_wp_at ((\<noteq>) cap.NullCap) x22 and cte_wp_at (weak_derived x21) x22 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) x22 and ex_cte_cap_wp_to is_cnode_cap x23 and real_cte_at x22 and real_cte_at x23)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_move x21 x22 x23)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 7. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 8. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 9. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 10. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
A total of 11 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>x11 a b aa ba c' s. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba)); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> x11 \<and> cap_table_at (length b) a s \<and> cap_table_at (length ba) aa s \<and> cte_wp_at (is_derived (cdt s) (a, b) x11) (a, b) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, ba) s \<and> ex_cte_cap_wp_to is_cnode_cap (aa, ba) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<forall>r\<in>obj_refs x11. \<forall>a b. (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s \<and> \<not> is_zombie x11)\<rbrakk> \<Longrightarrow> valid_objs s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s
 2. \<And>x11 a b aa ba c' s. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba)); (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) c' \<circ> cteCap) (cte_map (a, b)) s) and cte_wp_at' (untyped_derived_eq c' \<circ> cteCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba)) and (\<lambda>s. cte_map (a, b) \<noteq> cte_map (aa, ba)) and ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)))) s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba))) s
 3. \<And>x21 x22 x23. \<lbrakk>\<exists>c'. cap_relation x21 c' \<and> ci' = Move c' (cte_map x22) (cte_map x23); ci = MoveCall x21 x22 x23\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) x23 and cte_wp_at ((\<noteq>) cap.NullCap) x22 and cte_wp_at (weak_derived x21) x22 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) x22 and ex_cte_cap_wp_to is_cnode_cap x23 and real_cte_at x22 and real_cte_at x23)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_move x21 x22 x23)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 4. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 5. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 6. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 7. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 8. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>x11 a b aa ba c' s. \<lbrakk>ci = InsertCall x11 (a, b) (aa, ba); cap_relation x11 c'; ci' = Insert c' (cte_map (a, b)) (cte_map (aa, ba)); (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) c' \<circ> cteCap) (cte_map (a, b)) s) and cte_wp_at' (untyped_derived_eq c' \<circ> cteCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba)) and (\<lambda>s. cte_map (a, b) \<noteq> cte_map (aa, ba)) and ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)))) s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba))) s
 2. \<And>x21 x22 x23. \<lbrakk>\<exists>c'. cap_relation x21 c' \<and> ci' = Move c' (cte_map x22) (cte_map x23); ci = MoveCall x21 x22 x23\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) x23 and cte_wp_at ((\<noteq>) cap.NullCap) x22 and cte_wp_at (weak_derived x21) x22 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) x22 and ex_cte_cap_wp_to is_cnode_cap x23 and real_cte_at x22 and real_cte_at x23)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_move x21 x22 x23)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 3. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 4. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 5. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 6. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>x21 x22 x23. \<lbrakk>\<exists>c'. cap_relation x21 c' \<and> ci' = Move c' (cte_map x22) (cte_map x23); ci = MoveCall x21 x22 x23\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) x23 and cte_wp_at ((\<noteq>) cap.NullCap) x22 and cte_wp_at (weak_derived x21) x22 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) x22 and ex_cte_cap_wp_to is_cnode_cap x23 and real_cte_at x22 and real_cte_at x23)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_move x21 x22 x23)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 2. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 3. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 4. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>x21 a b aa ba c'. \<lbrakk>ci = MoveCall x21 (a, b) (aa, ba); cap_relation x21 c'; ci' = Move c' (cte_map (a, b)) (cte_map (aa, ba))\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) (aa, ba) and cte_wp_at ((\<noteq>) cap.NullCap) (a, b) and cte_wp_at (weak_derived x21) (a, b) and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) (a, b) and ex_cte_cap_wp_to is_cnode_cap (aa, ba) and cap_table_at (length b) a and cap_table_at (length ba) aa)) (invs' and sch_act_simple and (cte_wp_at' (\<lambda>c. weak_derived' c' (cteCap c)) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = c') (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (cte_map (a, b)) and valid_cap' c' and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba)) and ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)))) (cap_move x21 (a, b) (aa, ba)) (cteMove c' (cte_map (a, b)) (cte_map (aa, ba)))
 2. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 3. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 4. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (8 subgoals):
 1. \<And>x21 a b aa ba c'. \<lbrakk>ci = MoveCall x21 (a, b) (aa, ba); cap_relation x21 c'; ci' = Move c' (cte_map (a, b)) (cte_map (aa, ba))\<rbrakk> \<Longrightarrow> corres dc (?Q42 x21 a b aa ba c') (?Q'42 x21 a b aa ba c') (cap_move x21 (a, b) (aa, ba)) (cteMove c' (cte_map (a, b)) (cte_map (aa, ba)))
 2. \<And>x21 a b aa ba c' s. \<lbrakk>ci = MoveCall x21 (a, b) (aa, ba); cap_relation x21 c'; ci' = Move c' (cte_map (a, b)) (cte_map (aa, ba)); (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) (aa, ba) and cte_wp_at ((\<noteq>) cap.NullCap) (a, b) and cte_wp_at (weak_derived x21) (a, b) and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) (a, b) and ex_cte_cap_wp_to is_cnode_cap (aa, ba) and cap_table_at (length b) a and cap_table_at (length ba) aa)) s\<rbrakk> \<Longrightarrow> ?Q42 x21 a b aa ba c' s
 3. \<And>x21 a b aa ba c' s. \<lbrakk>ci = MoveCall x21 (a, b) (aa, ba); cap_relation x21 c'; ci' = Move c' (cte_map (a, b)) (cte_map (aa, ba)); (invs' and sch_act_simple and (cte_wp_at' (\<lambda>c. weak_derived' c' (cteCap c)) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = c') (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (cte_map (a, b)) and valid_cap' c' and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba)) and ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)))) s\<rbrakk> \<Longrightarrow> ?Q'42 x21 a b aa ba c' s
 4. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 5. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 6. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 7. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 8. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>x21 a b aa ba c' s. \<lbrakk>ci = MoveCall x21 (a, b) (aa, ba); cap_relation x21 c'; ci' = Move c' (cte_map (a, b)) (cte_map (aa, ba)); (einvs and simple_sched_action and (valid_cap x21 and cte_wp_at ((=) cap.NullCap) (aa, ba) and cte_wp_at ((\<noteq>) cap.NullCap) (a, b) and cte_wp_at (weak_derived x21) (a, b) and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x21) (a, b) and ex_cte_cap_wp_to is_cnode_cap (aa, ba) and cap_table_at (length b) a and cap_table_at (length ba) aa)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) (a, b) and cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, ba) and valid_cap x21 and tcb_cap_valid x21 (aa, ba) and K ((a, b) \<noteq> (aa, ba))) s
 2. \<And>x21 a b aa ba c' s. \<lbrakk>ci = MoveCall x21 (a, b) (aa, ba); cap_relation x21 c'; ci' = Move c' (cte_map (a, b)) (cte_map (aa, ba)); (invs' and sch_act_simple and (cte_wp_at' (\<lambda>c. weak_derived' c' (cteCap c)) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = c') (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (cte_map (a, b)) and valid_cap' c' and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba)) and ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' c' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba))) s
 3. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 4. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 5. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 6. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>x21 a b aa ba c' s. \<lbrakk>ci = MoveCall x21 (a, b) (aa, ba); cap_relation x21 c'; ci' = Move c' (cte_map (a, b)) (cte_map (aa, ba)); (invs' and sch_act_simple and (cte_wp_at' (\<lambda>c. weak_derived' c' (cteCap c)) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = c') (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (cte_map (a, b)) and valid_cap' c' and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba)) and ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' c' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (aa, ba))) s
 2. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 3. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 4. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (5 subgoals):
 1. \<And>x3. \<lbrakk>ci' = Revoke (cte_map x3); ci = RevokeCall x3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x3) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x3)) (cap_revoke x3) (cteRevoke (cte_map x3))
 2. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 3. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 4. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 5. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>x4. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and real_cte_at x4) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) (cap_delete x4) (cteDelete (cte_map x4) True)
 2. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (5 subgoals):
 1. \<And>x4 s. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4; (einvs and simple_sched_action and real_cte_at x4) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) x4 and emptyable x4) s
 2. \<And>x4 s. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) s
 3. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 4. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 5. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>x4 s. \<lbrakk>ci' = Delete (cte_map x4); ci = DeleteCall x4; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map x4)) s
 2. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>x51 x52 x53 x54 x55. \<lbrakk>\<exists>sc'. cap_relation x51 sc' \<and> (\<exists>pc'. cap_relation x52 pc' \<and> ci' = Rotate sc' pc' (cte_map x53) (cte_map x54) (cte_map x55)); ci = RotateCall x51 x52 x53 x54 x55\<rbrakk> \<Longrightarrow> (x53 = x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x55 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x55 and cte_wp_at ((\<noteq>) cap.NullCap) x55 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x55 \<noteq> x54 \<and> x54 \<noteq> x55) and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap x51 x55 x52 x54)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (x53 \<noteq> x55 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x51 and valid_cap x52 and real_cte_at x53 and real_cte_at x55 and real_cte_at x54 and cte_wp_at (weak_derived x51) x53 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x51) x53 and cte_wp_at ((\<noteq>) cap.NullCap) x53 and cte_wp_at (weak_derived x52) x54 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = x52) x54 and cte_wp_at ((\<noteq>) cap.NullCap) x54 and (\<lambda>y. x53 \<noteq> x54 \<and> x54 \<noteq> x55) and cte_wp_at (\<lambda>c. c = cap.NullCap) x55 and ex_cte_cap_wp_to is_cnode_cap x54 and ex_cte_cap_wp_to is_cnode_cap x55)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move x52 x54 x55;
cap_move x51 x53 x54
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3. \<lbrakk>\<exists>sc'. cap_relation cap1 sc' \<and> (\<exists>pc'. cap_relation cap2 pc' \<and> ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3)); ci = RotateCall cap1 cap2 p1 p2 p3\<rbrakk> \<Longrightarrow> (p1 = p3 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p3 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p3 and cte_wp_at ((\<noteq>) cap.NullCap) p3 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p3 \<noteq> p2 \<and> p2 \<noteq> p3) and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap cap1 p3 cap2 p2)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (p1 \<noteq> p3 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3)\<rbrakk> \<Longrightarrow> (p1 = p3 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p3 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p3 and cte_wp_at ((\<noteq>) cap.NullCap) p3 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p3 \<noteq> p2 \<and> p2 \<noteq> p3) and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap cap1 p3 cap2 p2)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)) \<and> (p1 \<noteq> p3 \<longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True))
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 = p3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p3 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p3 and cte_wp_at ((\<noteq>) cap.NullCap) p3 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p3 \<noteq> p2 \<and> p2 \<noteq> p3) and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (cap_swap cap1 p3 cap2 p2)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p3 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p3 and cte_wp_at ((\<noteq>) cap.NullCap) p3 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p3 \<noteq> p2 \<and> p2 \<noteq> p3) and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p3) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p3) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p3 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (cap_swap cap1 p3 cap2 p2) (cteSwap sc' (cte_map p3) pc' (cte_map p2))
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3\<rbrakk> \<Longrightarrow> corres dc (?Q107 cap1 cap2 p1 p2 p3 sc' pc') (?Q'107 cap1 cap2 p1 p2 p3 sc' pc') (cap_swap cap1 p3 cap2 p2) (cteSwap sc' (cte_map p3) pc' (cte_map p2))
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p3 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p3 and cte_wp_at ((\<noteq>) cap.NullCap) p3 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p3 \<noteq> p2 \<and> p2 \<noteq> p3) and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s\<rbrakk> \<Longrightarrow> ?Q107 cap1 cap2 p1 p2 p3 sc' pc' s
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p3) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p3) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p3 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> ?Q'107 cap1 cap2 p1 p2 p3 sc' pc' s
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3; wellformed_cap cap1 \<and> wellformed_cap cap2\<rbrakk> \<Longrightarrow> corres dc (?P111 cap1 cap2 p1 p2 p3 sc' pc') (?Q'107 cap1 cap2 p1 p2 p3 sc' pc') (cap_swap cap1 p3 cap2 p2) (cteSwap sc' (cte_map p3) pc' (cte_map p2))
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p3 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p3 and cte_wp_at ((\<noteq>) cap.NullCap) p3 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p3 \<noteq> p2 \<and> p2 \<noteq> p3) and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s\<rbrakk> \<Longrightarrow> (?P111 cap1 cap2 p1 p2 p3 sc' pc' and (\<lambda>s. wellformed_cap cap1 \<and> wellformed_cap cap2)) s
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p3) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p3) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p3 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> ?Q'107 cap1 cap2 p1 p2 p3 sc' pc' s
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (5 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3; invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> cap1 \<and> s \<turnstile> cap2 \<and> real_cte_at p3 s \<and> real_cte_at p2 s \<and> cte_wp_at (weak_derived cap1) p3 s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p3 s \<and> cte_wp_at ((\<noteq>) cap.NullCap) p3 s \<and> cte_wp_at (weak_derived cap2) p2 s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 s \<and> cte_wp_at ((\<noteq>) cap.NullCap) p2 s \<and> p3 \<noteq> p2 \<and> p2 \<noteq> p3 \<and> ex_cte_cap_wp_to is_cnode_cap p2 s \<and> ex_cte_cap_wp_to is_cnode_cap p3 s\<rbrakk> \<Longrightarrow> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> (\<forall>cap. tcb_cap_valid cap p3 s) \<and> (\<forall>cap. tcb_cap_valid cap p2 s) \<and> wellformed_cap cap1 \<and> wellformed_cap cap2
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p3) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p3) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p3 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. cte_wp_at' (weak_derived' sc' \<circ> cteCap) (cte_map p3) s \<and> cte_wp_at' (weak_derived' pc' \<circ> cteCap) (cte_map p2) s)) s
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 4. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 5. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p3 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p3) (cte_map p2) (cte_map p3); p1 = p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p3) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p3) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p3 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. cte_wp_at' (weak_derived' sc' \<circ> cteCap) (cte_map p3) s \<and> cte_wp_at' (weak_derived' pc' \<circ> cteCap) (cte_map p2) s)) s
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and valid_cnode_inv' ci') (liftE (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od)) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True)
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. cte_map p1 \<noteq> cte_map p3 \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (if cte_map p1 = cte_map p3 then cteSwap sc' (cte_map p3) pc' (cte_map p2) else do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; (s, s') \<in> state_relation; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. cte_map p1 \<noteq> cte_map p3 \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s'\<rbrakk> \<Longrightarrow> cte_map p1 \<noteq> cte_map p3
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. cte_map p1 \<noteq> cte_map p3 \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (if cte_map p1 = cte_map p3 then cteSwap sc' (cte_map p3) pc' (cte_map p2) else do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb; cte_map (a, b) = cte_map (ab, bb)\<rbrakk> \<Longrightarrow> False
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. cte_map p1 \<noteq> cte_map p3 \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (if cte_map p1 = cte_map p3 then cteSwap sc' (cte_map p3) pc' (cte_map p2) else do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb\<rbrakk> \<Longrightarrow> pspace_distinct s
 4. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb; (a, b) = (ab, bb)\<rbrakk> \<Longrightarrow> False
 5. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. cte_map p1 \<noteq> cte_map p3 \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (if cte_map p1 = cte_map p3 then cteSwap sc' (cte_map p3) pc' (cte_map p2) else do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 6. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb\<rbrakk> \<Longrightarrow> pspace_aligned s
 2. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb\<rbrakk> \<Longrightarrow> pspace_distinct s
 3. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb; (a, b) = (ab, bb)\<rbrakk> \<Longrightarrow> False
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. cte_map p1 \<noteq> cte_map p3 \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (if cte_map p1 = cte_map p3 then cteSwap sc' (cte_map p3) pc' (cte_map p2) else do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (5 subgoals):
 1. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb\<rbrakk> \<Longrightarrow> pspace_distinct s
 2. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb; (a, b) = (ab, bb)\<rbrakk> \<Longrightarrow> False
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. cte_map p1 \<noteq> cte_map p3 \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (if cte_map p1 = cte_map p3 then cteSwap sc' (cte_map p3) pc' (cte_map p2) else do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 4. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 5. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 a b aa ba ab bb sc' pc' s s'. \<lbrakk>ci = RotateCall cap1 cap2 (a, b) (aa, ba) (ab, bb); cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map (ab, bb)) (cte_map (aa, ba)) (cte_map (ab, bb)); (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; valid_cap' sc' s'; simple_sched_action s; valid_cap' pc' s'; s \<turnstile> cap1; cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map (ab, bb)) s'; s \<turnstile> cap2; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map (ab, bb)) s'; cap_table_at (length b) a s; cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map (aa, ba)) s'; cap_table_at (length bb) ab s; cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map (aa, ba)) s'; cap_table_at (length ba) aa s; cte_wp_at (weak_derived cap1) (a, b) s; cte_map (aa, ba) \<noteq> cte_map (ab, bb); cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) (a, b) s; sc' \<noteq> capability.NullCap; cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s; pc' \<noteq> capability.NullCap; cte_wp_at (weak_derived cap2) (aa, ba) s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) (aa, ba) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s'; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, bb)) s'; cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; a = ab \<longrightarrow> b \<noteq> bb; a = aa \<longrightarrow> b \<noteq> ba; cte_wp_at (\<lambda>c. c = cap.NullCap) (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (aa, ba) s; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; aa = ab \<longrightarrow> ba \<noteq> bb; (a, b) = (ab, bb)\<rbrakk> \<Longrightarrow> False
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. cte_map p1 \<noteq> cte_map p3 \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (if cte_map p1 = cte_map p3 then cteSwap sc' (cte_map p3) pc' (cte_map p2) else do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and (\<lambda>s. cte_map p1 \<noteq> cte_map p3 \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (if cte_map p1 = cte_map p3 then cteSwap sc' (cte_map p3) pc' (cte_map p2) else do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (5 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres dc (?Q178 cap1 cap2 p1 p2 p3 sc' pc') (?Q'178 cap1 cap2 p1 p2 p3 sc' pc') (do y <- cap_move cap2 p2 p3;
cap_move cap1 p1 p2
od) (do y <- cteMove pc' (cte_map p2) (cte_map p3);
cteMove sc' (cte_map p1) (cte_map p2)
od)
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s\<rbrakk> \<Longrightarrow> ?Q178 cap1 cap2 p1 p2 p3 sc' pc' s
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> ?Q'178 cap1 cap2 p1 p2 p3 sc' pc' s
 4. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 5. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (8 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> corres (?r'182 cap1 cap2 p1 p2 p3 sc' pc') (?P182 cap1 cap2 p1 p2 p3 sc' pc') (?P'182 cap1 cap2 p1 p2 p3 sc' pc') (cap_move cap2 p2 p3) (cteMove pc' (cte_map p2) (cte_map p3))
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' y ya. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; ?r'182 cap1 cap2 p1 p2 p3 sc' pc' y ya\<rbrakk> \<Longrightarrow> corres dc (?R182 cap1 cap2 p1 p2 p3 sc' pc' y) (?R'182 cap1 cap2 p1 p2 p3 sc' pc' ya) (cap_move cap1 p1 p2) (cteMove sc' (cte_map p1) (cte_map p2))
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?Q182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cap_move cap2 p2 p3 \<lbrace>?R182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace>
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?Q'182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cteMove pc' (cte_map p2) (cte_map p3) \<lbrace>?R'182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace>
 5. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s\<rbrakk> \<Longrightarrow> (?P182 cap1 cap2 p1 p2 p3 sc' pc' and ?Q182 cap1 cap2 p1 p2 p3 sc' pc') s
 6. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (?P'182 cap1 cap2 p1 p2 p3 sc' pc' and ?Q'182 cap1 cap2 p1 p2 p3 sc' pc') s
 7. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 8. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' y ya. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R182 cap1 cap2 p1 p2 p3 sc' pc' y) (?R'182 cap1 cap2 p1 p2 p3 sc' pc' ya) (cap_move cap1 p1 p2) (cteMove sc' (cte_map p1) (cte_map p2))
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?Q182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cap_move cap2 p2 p3 \<lbrace>?R182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace>
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?Q'182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cteMove pc' (cte_map p2) (cte_map p3) \<lbrace>?R'182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace>
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) p2 and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and valid_cap cap2 and tcb_cap_valid cap2 p3 and K (p2 \<noteq> p3) and ?Q182 cap1 cap2 p1 p2 p3 sc' pc') s
 5. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p2) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and ?Q'182 cap1 cap2 p1 p2 p3 sc' pc') s
 6. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?Q182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cap_move cap2 p2 p3 \<lbrace>\<lambda>y. einvs and cte_wp_at (\<lambda>_. True) p1 and cte_wp_at (\<lambda>c. c = cap.NullCap) p2 and valid_cap cap1 and tcb_cap_valid cap1 p2 and K (p1 \<noteq> p2)\<rbrace>
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?Q'182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cteMove pc' (cte_map p2) (cte_map p3) \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p1) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p2)\<rbrace>
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) p2 and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and valid_cap cap2 and tcb_cap_valid cap2 p3 and K (p2 \<noteq> p3) and ?Q182 cap1 cap2 p1 p2 p3 sc' pc') s
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p2) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and ?Q'182 cap1 cap2 p1 p2 p3 sc' pc') s
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?P'208 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cap_move cap2 p2 p3 \<lbrace>\<lambda>rv s. cte_wp_at (\<lambda>_. True) p1 s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) p2 s \<and> s \<turnstile> cap1 \<and> tcb_cap_valid cap1 p2 s \<and> K (p1 \<noteq> p2) s\<rbrace>
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?Q'182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cteMove pc' (cte_map p2) (cte_map p3) \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p1) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p2)\<rbrace>
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) p2 and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and valid_cap cap2 and tcb_cap_valid cap2 p3 and K (p2 \<noteq> p3) and (\<lambda>s. (invs and valid_cap cap2 and cte_wp_at ((=) cap.NullCap) p3 and tcb_cap_valid cap2 p3 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) p2 and ex_cte_cap_wp_to (appropriate_cte_cap cap2) p3 and K (p2 \<noteq> p3) and K (\<not> is_master_reply_cap cap2)) s \<and> valid_list s \<and> valid_sched s \<and> ?P'208 cap1 cap2 p1 p2 p3 sc' pc' s)) s
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p2) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and ?Q'182 cap1 cap2 p1 p2 p3 sc' pc') s
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?P'208 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cap_move cap2 p2 p3 \<lbrace>\<lambda>rv s. (\<exists>cap. caps_of_state s p1 = Some cap) \<and> caps_of_state s p2 = Some cap.NullCap \<and> s \<turnstile> cap1 \<and> tcb_cap_valid cap1 p2 s \<and> p1 \<noteq> p2\<rbrace>
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc'. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3\<rbrakk> \<Longrightarrow> \<lbrace>?Q'182 cap1 cap2 p1 p2 p3 sc' pc'\<rbrace> cteMove pc' (cte_map p2) (cte_map p3) \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p1) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p2)\<rbrace>
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) p2 and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and valid_cap cap2 and tcb_cap_valid cap2 p3 and K (p2 \<noteq> p3) and (\<lambda>s. (invs and valid_cap cap2 and cte_wp_at ((=) cap.NullCap) p3 and tcb_cap_valid cap2 p3 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) p2 and ex_cte_cap_wp_to (appropriate_cte_cap cap2) p3 and K (p2 \<noteq> p3) and K (\<not> is_master_reply_cap cap2)) s \<and> valid_list s \<and> valid_sched s \<and> ?P'208 cap1 cap2 p1 p2 p3 sc' pc' s)) s
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p2) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and ?Q'182 cap1 cap2 p1 p2 p3 sc' pc') s
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (einvs and simple_sched_action and (valid_cap cap1 and valid_cap cap2 and real_cte_at p1 and real_cte_at p3 and real_cte_at p2 and cte_wp_at (weak_derived cap1) p1 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 and cte_wp_at ((\<noteq>) cap.NullCap) p1 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 and cte_wp_at ((\<noteq>) cap.NullCap) p2 and (\<lambda>y. p1 \<noteq> p2 \<and> p2 \<noteq> p3) and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and ex_cte_cap_wp_to is_cnode_cap p2 and ex_cte_cap_wp_to is_cnode_cap p3)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) p2 and cte_wp_at (\<lambda>c. c = cap.NullCap) p3 and valid_cap cap2 and tcb_cap_valid cap2 p3 and K (p2 \<noteq> p3) and (\<lambda>s. (invs and valid_cap cap2 and cte_wp_at ((=) cap.NullCap) p3 and tcb_cap_valid cap2 p3 and cte_wp_at (weak_derived cap2) p2 and cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) p2 and ex_cte_cap_wp_to (appropriate_cte_cap cap2) p3 and K (p2 \<noteq> p3) and K (\<not> is_master_reply_cap cap2)) s \<and> valid_list s \<and> valid_sched s \<and> (\<exists>cap. ((caps_of_state s)(p3 \<mapsto> cap2, p2 \<mapsto> cap.NullCap)) p1 = Some cap) \<and> ((caps_of_state s)(p3 \<mapsto> cap2, p2 \<mapsto> cap.NullCap)) p2 = Some cap.NullCap \<and> s \<turnstile> cap1 \<and> tcb_cap_valid cap1 p2 s \<and> p1 \<noteq> p2)) s
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p2) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. (invs' s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap c) pc') (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> pc' = cteCap c) (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (cte_map p2) s \<and> valid_cap' pc' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map p1) s \<and> (if cte_map p2 = cte_map p1 then weak_derived' sc' capability.NullCap \<and> capability.NullCap \<noteq> capability.NullCap else if cte_map p3 = cte_map p1 then weak_derived' sc' pc' \<and> pc' \<noteq> capability.NullCap else cte_wp_at' (\<lambda>x. weak_derived' sc' (cteCap x) \<and> cteCap x \<noteq> capability.NullCap) (cte_map p1) s)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map p2) s \<and> (if cte_map p2 = cte_map p2 then capability.NullCap = capability.NullCap else if cte_map p3 = cte_map p2 then pc' = capability.NullCap else cte_wp_at' (\<lambda>x. cteCap x = capability.NullCap) (cte_map p2) s))) s
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> cap1 \<and> s \<turnstile> cap2 \<and> real_cte_at p1 s \<and> real_cte_at p3 s \<and> real_cte_at p2 s \<and> cte_wp_at (weak_derived cap1) p1 s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 s \<and> cte_wp_at ((\<noteq>) cap.NullCap) p1 s \<and> cte_wp_at (weak_derived cap2) p2 s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 s \<and> cte_wp_at ((\<noteq>) cap.NullCap) p2 s \<and> p1 \<noteq> p2 \<and> p2 \<noteq> p3 \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) p3 s \<and> ex_cte_cap_wp_to is_cnode_cap p2 s \<and> ex_cte_cap_wp_to is_cnode_cap p3 s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) p2 s \<and> cte_wp_at ((=) cap.NullCap) p3 s \<and> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) p2 s \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap2) p3 s \<and> \<not> is_master_reply_cap cap2 \<and> (\<exists>cap. caps_of_state s p1 = Some cap)
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p2) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. (invs' s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap c) pc') (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> pc' = cteCap c) (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (cte_map p2) s \<and> valid_cap' pc' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map p1) s \<and> (if cte_map p2 = cte_map p1 then weak_derived' sc' capability.NullCap \<and> capability.NullCap \<noteq> capability.NullCap else if cte_map p3 = cte_map p1 then weak_derived' sc' pc' \<and> pc' \<noteq> capability.NullCap else cte_wp_at' (\<lambda>x. weak_derived' sc' (cteCap x) \<and> cteCap x \<noteq> capability.NullCap) (cte_map p1) s)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map p2) s \<and> (if cte_map p2 = cte_map p2 then capability.NullCap = capability.NullCap else if cte_map p3 = cte_map p2 then pc' = capability.NullCap else cte_wp_at' (\<lambda>x. cteCap x = capability.NullCap) (cte_map p2) s))) s
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> cap1; s \<turnstile> cap2; real_cte_at p1 s; real_cte_at p3 s; real_cte_at p2 s; cte_wp_at (weak_derived cap1) p1 s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 s; cte_wp_at ((\<noteq>) cap.NullCap) p1 s; cte_wp_at (weak_derived cap2) p2 s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 s; cte_wp_at ((\<noteq>) cap.NullCap) p2 s; p1 \<noteq> p2; p2 \<noteq> p3; cte_wp_at (\<lambda>c. c = cap.NullCap) p3 s; ex_cte_cap_wp_to is_cnode_cap p2 s; ex_cte_cap_wp_to is_cnode_cap p3 s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) p2 s \<and> cte_wp_at ((=) cap.NullCap) p3 s \<and> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) p2 s \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap2) p3 s \<and> \<not> is_master_reply_cap cap2 \<and> (\<exists>cap. caps_of_state s p1 = Some cap)
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p2) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. (invs' s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap c) pc') (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> pc' = cteCap c) (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (cte_map p2) s \<and> valid_cap' pc' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map p1) s \<and> (if cte_map p2 = cte_map p1 then weak_derived' sc' capability.NullCap \<and> capability.NullCap \<noteq> capability.NullCap else if cte_map p3 = cte_map p1 then weak_derived' sc' pc' \<and> pc' \<noteq> capability.NullCap else cte_wp_at' (\<lambda>x. weak_derived' sc' (cteCap x) \<and> cteCap x \<noteq> capability.NullCap) (cte_map p1) s)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map p2) s \<and> (if cte_map p2 = cte_map p2 then capability.NullCap = capability.NullCap else if cte_map p3 = cte_map p2 then pc' = capability.NullCap else cte_wp_at' (\<lambda>x. cteCap x = capability.NullCap) (cte_map p2) s))) s
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> cap1; s \<turnstile> cap2; real_cte_at p1 s; real_cte_at p3 s; real_cte_at p2 s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap1) p1 s; cte_wp_at ((\<noteq>) cap.NullCap) p1 s; cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = cap2) p2 s; cte_wp_at ((\<noteq>) cap.NullCap) p2 s; p1 \<noteq> p2; p2 \<noteq> p3; cte_wp_at (\<lambda>c. c = cap.NullCap) p3 s; ex_cte_cap_wp_to is_cnode_cap p2 s; ex_cte_cap_wp_to is_cnode_cap p3 s; \<not> is_master_reply_cap cap1; \<not> is_master_reply_cap cap2\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) p2 s \<and> cte_wp_at ((=) cap.NullCap) p3 s \<and> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) p2 s \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap2) p3 s \<and> \<not> is_master_reply_cap cap2 \<and> (\<exists>cap. caps_of_state s p1 = Some cap)
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p2) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. (invs' s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap c) pc') (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> pc' = cteCap c) (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (cte_map p2) s \<and> valid_cap' pc' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map p1) s \<and> (if cte_map p2 = cte_map p1 then weak_derived' sc' capability.NullCap \<and> capability.NullCap \<noteq> capability.NullCap else if cte_map p3 = cte_map p1 then weak_derived' sc' pc' \<and> pc' \<noteq> capability.NullCap else cte_wp_at' (\<lambda>x. weak_derived' sc' (cteCap x) \<and> cteCap x \<noteq> capability.NullCap) (cte_map p1) s)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map p2) s \<and> (if cte_map p2 = cte_map p2 then capability.NullCap = capability.NullCap else if cte_map p3 = cte_map p2 then pc' = capability.NullCap else cte_wp_at' (\<lambda>x. cteCap x = capability.NullCap) (cte_map p2) s))) s
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; (invs' and sch_act_simple and (valid_cap' sc' and valid_cap' pc' and cte_wp_at' (\<lambda>c. weak_derived' sc' (cteCap c)) (cte_map p1) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = sc') (cte_map p1) and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c)) (cte_map p2) and cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = pc') (cte_map p2) and (\<lambda>y. cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s))) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' pc' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map p2) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) and (\<lambda>s. (invs' s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap c) pc') (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> pc' = cteCap c) (cte_map p2) s \<and> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (cte_map p2) s \<and> valid_cap' pc' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map p3) s) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map p1) s \<and> (if cte_map p2 = cte_map p1 then weak_derived' sc' capability.NullCap \<and> capability.NullCap \<noteq> capability.NullCap else if cte_map p3 = cte_map p1 then weak_derived' sc' pc' \<and> pc' \<noteq> capability.NullCap else cte_wp_at' (\<lambda>x. weak_derived' sc' (cteCap x) \<and> cteCap x \<noteq> capability.NullCap) (cte_map p1) s)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map p2) s \<and> (if cte_map p2 = cte_map p2 then capability.NullCap = capability.NullCap else if cte_map p3 = cte_map p2 then pc' = capability.NullCap else cte_wp_at' (\<lambda>x. cteCap x = capability.NullCap) (cte_map p2) s))) s
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s \<and> sch_act_simple s \<and> valid_cap' sc' s \<and> valid_cap' pc' s \<and> (\<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte)) \<and> (\<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = sc')) \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' pc' (cteCap cte)) \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = pc')) \<and> cte_map p1 \<noteq> cte_map p2 \<and> cte_map p2 \<noteq> cte_map p3 \<and> sc' \<noteq> capability.NullCap \<and> pc' \<noteq> capability.NullCap \<and> (\<exists>cte. ctes_of s (cte_map p3) = Some cte \<and> cteCap cte = capability.NullCap) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s\<rbrakk> \<Longrightarrow> cte_map p2 \<noteq> cte_map p1 \<and> (cte_map p2 \<noteq> cte_map p1 \<longrightarrow> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' pc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap) \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' (cteCap cte) pc') \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> (isUntypedCap (cteCap cte) \<longrightarrow> pc' = cteCap cte)) \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> cteCap cte \<noteq> capability.NullCap) \<and> (\<exists>cte. ctes_of s (cte_map p1) = Some cte) \<and> (\<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap) \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte))
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap\<rbrakk> \<Longrightarrow> cte_map p2 \<noteq> cte_map p1 \<and> (cte_map p2 \<noteq> cte_map p1 \<longrightarrow> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' pc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap) \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' (cteCap cte) pc') \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> (isUntypedCap (cteCap cte) \<longrightarrow> pc' = cteCap cte)) \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> cteCap cte \<noteq> capability.NullCap) \<and> (\<exists>cte. ctes_of s (cte_map p1) = Some cte) \<and> (\<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap) \<and> (\<exists>cte. ctes_of s (cte_map p2) = Some cte))
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (10 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap\<rbrakk> \<Longrightarrow> cte_map p2 \<noteq> cte_map p1
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' pc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' (cteCap cte) pc'
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> (isUntypedCap (cteCap cte) \<longrightarrow> pc' = cteCap cte)
 5. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> cteCap cte \<noteq> capability.NullCap
 6. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte
 7. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 8. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 9. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 10. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (9 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' pc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' (cteCap cte) pc'
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> (isUntypedCap (cteCap cte) \<longrightarrow> pc' = cteCap cte)
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> cteCap cte \<noteq> capability.NullCap
 5. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte
 6. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 7. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 8. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 9. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (8 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> weak_derived' (cteCap cte) pc'
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> (isUntypedCap (cteCap cte) \<longrightarrow> pc' = cteCap cte)
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> cteCap cte \<noteq> capability.NullCap
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte
 5. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 6. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 7. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 8. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (8 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctea = cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some cte; isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = sc'; ctec = cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some cteb; isUntypedCap (cteCap cteb) \<longrightarrow> cteCap cteb = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> weak_derived' (cteCap cteb) pc'
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> (isUntypedCap (cteCap cte) \<longrightarrow> pc' = cteCap cte)
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> cteCap cte \<noteq> capability.NullCap
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte
 5. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 6. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 7. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 8. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> (isUntypedCap (cteCap cte) \<longrightarrow> pc' = cteCap cte)
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> cteCap cte \<noteq> capability.NullCap
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 5. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 6. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte \<and> cteCap cte \<noteq> capability.NullCap
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctea = cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some cte; isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = sc'; ctec = cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some cteb; isUntypedCap (cteCap cteb) \<longrightarrow> cteCap cteb = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> cteCap cteb \<noteq> capability.NullCap
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 4. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 5. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (5 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 3. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 4. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 5. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p1) = Some cte \<and> weak_derived' sc' (cteCap cte) \<and> cteCap cte \<noteq> capability.NullCap
 2. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 3. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>cap1 cap2 p1 p2 p3 sc' pc' s cte ctea cteb ctec cted. \<lbrakk>ci = RotateCall cap1 cap2 p1 p2 p3; cap_relation cap1 sc'; cap_relation cap2 pc'; ci' = Rotate sc' pc' (cte_map p1) (cte_map p2) (cte_map p3); p1 \<noteq> p3; cte_map p1 \<noteq> cte_map p3; invs' s; sch_act_simple s; valid_cap' sc' s; valid_cap' pc' s; cte_map p1 \<noteq> cte_map p2; cte_map p2 \<noteq> cte_map p3; sc' \<noteq> capability.NullCap; pc' \<noteq> capability.NullCap; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p2) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map p3) s; ctes_of s (cte_map p1) = Some cte; weak_derived' sc' (cteCap cte); ctes_of s (cte_map p1) = Some ctea; isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = sc'; ctes_of s (cte_map p2) = Some cteb; weak_derived' pc' (cteCap cteb); ctes_of s (cte_map p2) = Some ctec; isUntypedCap (cteCap ctec) \<longrightarrow> cteCap ctec = pc'; ctes_of s (cte_map p3) = Some cted; cteCap cted = capability.NullCap; cte_map p2 \<noteq> cte_map p1\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (cte_map p2) = Some cte
 2. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (2 subgoals):
 1. \<And>x6. \<lbrakk>ci' = SaveCaller (cte_map x6); ci = SaveCall x6\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap x6 and cte_wp_at (\<lambda>c. c = cap.NullCap) x6 and real_cte_at x6)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map x6) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x6))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) x6 | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map x6) | _ \<Rightarrow> haskell_fail []
od)
 2. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (2 subgoals):
 1. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot (cte_map prod) | _ \<Rightarrow> haskell_fail []
od)
 2. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (2 subgoals):
 1. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
cap <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap (thread + 2 ^ cte_level_bits * tcbCallerSlot) (cte_map prod) | _ \<Rightarrow> haskell_fail []
od)
 2. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> corres dc (?Q418 prod) (?Q'418 prod) (do thread <- gets cur_thread;
cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail
od) (do thread <- getCurThread;
cap <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap (thread + 2 ^ cte_level_bits * tcbCallerSlot) (cte_map prod) | _ \<Rightarrow> haskell_fail []
od)
 2. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ?Q418 prod s
 3. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ?Q'418 prod s
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada\<rbrakk> \<Longrightarrow> corres dc (?R422 prod thread) (?R'422 prod threada) (do cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail
od) (do cap <- getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot);
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap (threada + 2 ^ cte_level_bits * tcbCallerSlot) (cte_map prod) | _ \<Rightarrow> haskell_fail []
od)
 2. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>?R422 prod\<rbrace>
 3. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>?R'422 prod\<rbrace>
 4. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 5. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> corres dc (?R422 prod thread) (?R'422 prod threada) (do cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail
od) (do cap <- getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot);
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap (threada + 2 ^ cte_level_bits * tcbCallerSlot) (cte_map prod) | _ \<Rightarrow> haskell_fail []
od)
 2. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada\<rbrakk> \<Longrightarrow> thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)
 3. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>?R422 prod\<rbrace>
 4. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>?R'422 prod\<rbrace>
 5. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 6. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada\<rbrakk> \<Longrightarrow> thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)
 2. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> corres dc (?R422 prod thread) (?R'422 prod threada) (do cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail
od) (do cap <- getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot);
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap (threada + 2 ^ cte_level_bits * tcbCallerSlot) (cte_map prod) | _ \<Rightarrow> haskell_fail []
od)
 3. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>?R422 prod\<rbrace>
 4. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>?R'422 prod\<rbrace>
 5. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 6. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> corres dc (?R422 prod thread) (?R'422 prod threada) (do cap <- get_cap (thread, tcb_cnode_index 3);
case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail
od) (do cap <- getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot);
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap (threada + 2 ^ cte_level_bits * tcbCallerSlot) (cte_map prod) | _ \<Rightarrow> haskell_fail []
od)
 2. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>?R422 prod\<rbrace>
 3. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>?R'422 prod\<rbrace>
 4. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 5. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (9 subgoals):
 1. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)
 2. \<And>prod thread threada cap rv'. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3); cap_relation cap rv'\<rbrakk> \<Longrightarrow> corres dc (?R427 prod thread threada cap) (?R'427 prod thread threada rv') (case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail) (case rv' of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove rv' (threada + 2 ^ cte_level_bits * tcbCallerSlot) (cte_map prod) | _ \<Rightarrow> haskell_fail [])
 3. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q430 prod thread\<rbrace> get_cap (thread, tcb_cnode_index 3) \<lbrace>?R427 prod thread threada\<rbrace>
 4. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?R'427 prod thread threada\<rbrace>
 5. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and ?Q430 prod thread\<rbrace>
 6. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 7. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 8. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 9. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (8 subgoals):
 1. \<And>prod thread threada cap rv'. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3); cap_relation cap rv'\<rbrakk> \<Longrightarrow> corres dc (?R427 prod thread threada cap) (?R'427 prod thread threada rv') (case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail) (case rv' of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove rv' (threada + 2 ^ cte_level_bits * tcbCallerSlot) (cte_map prod) | _ \<Rightarrow> haskell_fail [])
 2. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q430 prod thread\<rbrace> get_cap (thread, tcb_cnode_index 3) \<lbrace>?R427 prod thread threada\<rbrace>
 3. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?R'427 prod thread threada\<rbrace>
 4. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and ?Q430 prod thread\<rbrace>
 5. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 6. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 7. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 8. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (8 subgoals):
 1. \<And>prod thread threada cap rv'. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3); cap_relation cap rv'\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod and valid_cap cap and K ((threada, tcb_cnode_index 3) \<noteq> prod)) s)) (\<lambda>s. isReplyCap rv' \<and> \<not> capReplyMaster rv' \<longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' rv' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod)) s) (case cap of cap.NullCap \<Rightarrow> return () | cap.ReplyCap x True xa \<Rightarrow> fail | cap.ReplyCap x False xa \<Rightarrow> cap_move cap (thread, tcb_cnode_index 3) prod | _ \<Rightarrow> fail) (case rv' of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove rv' (threada + 2 ^ cte_level_bits * tcbCallerSlot) (cte_map prod) | _ \<Rightarrow> haskell_fail [])
 2. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q430 prod thread\<rbrace> get_cap (thread, tcb_cnode_index 3) \<lbrace>\<lambda>cap s. (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod and valid_cap cap and K ((threada, tcb_cnode_index 3) \<noteq> prod)) s)\<rbrace>
 3. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. isReplyCap rv' \<and> \<not> capReplyMaster rv' \<longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' rv' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod)) s\<rbrace>
 4. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and ?Q430 prod thread\<rbrace>
 5. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 6. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 7. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 8. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (8 subgoals):
 1. \<And>prod thread threada cap rv' x51 x52 x53. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3); rv' = capability.ReplyCap x51 x52 (AllowGrant \<in> x53); cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> \<not> x52 \<longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) prod s \<and> real_cte_at prod s \<and> s \<turnstile> cap.ReplyCap x51 False x53 \<and> (threada, tcb_cnode_index 3) \<noteq> prod) (\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>c. weak_derived' (capability.ReplyCap x51 False (AllowGrant \<in> x53)) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) s) (cap_move (cap.ReplyCap x51 False x53) (threada, tcb_cnode_index 3) prod) (cteMove (capability.ReplyCap x51 False (AllowGrant \<in> x53)) (cte_map (threada, tcb_cnode_index 3)) (cte_map prod))
 2. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q430 prod thread\<rbrace> get_cap (thread, tcb_cnode_index 3) \<lbrace>\<lambda>cap s. (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod and valid_cap cap and K ((threada, tcb_cnode_index 3) \<noteq> prod)) s)\<rbrace>
 3. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. isReplyCap rv' \<and> \<not> capReplyMaster rv' \<longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' rv' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod)) s\<rbrace>
 4. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and ?Q430 prod thread\<rbrace>
 5. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 6. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 7. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 8. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (8 subgoals):
 1. \<And>a b threada x51 x52 x53. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3); \<not> x52\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> s \<turnstile> cap.ReplyCap x51 False x53 \<and> (threada = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)) (\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>c. weak_derived' (capability.ReplyCap x51 False (AllowGrant \<in> x53)) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s) (cap_move (cap.ReplyCap x51 False x53) (threada, tcb_cnode_index 3) (a, b)) (cteMove (capability.ReplyCap x51 False (AllowGrant \<in> x53)) (cte_map (threada, tcb_cnode_index 3)) (cte_map (a, b)))
 2. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q430 prod thread\<rbrace> get_cap (thread, tcb_cnode_index 3) \<lbrace>\<lambda>cap s. (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod and valid_cap cap and K ((threada, tcb_cnode_index 3) \<noteq> prod)) s)\<rbrace>
 3. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. isReplyCap rv' \<and> \<not> capReplyMaster rv' \<longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' rv' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod)) s\<rbrace>
 4. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and ?Q430 prod thread\<rbrace>
 5. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 6. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 7. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 8. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (10 subgoals):
 1. \<And>a b threada x51 x52 x53. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3); \<not> x52\<rbrakk> \<Longrightarrow> corres dc (?Q446 a b threada x51 x52 x53) (?Q'446 a b threada x51 x52 x53) (cap_move (cap.ReplyCap x51 False x53) (threada, tcb_cnode_index 3) (a, b)) (cteMove (capability.ReplyCap x51 False (AllowGrant \<in> x53)) (cte_map (threada, tcb_cnode_index 3)) (cte_map (a, b)))
 2. \<And>a b threada x51 x52 x53 s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3); \<not> x52; invs s \<and> valid_list s \<and> valid_sched s \<and> cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> s \<turnstile> cap.ReplyCap x51 False x53 \<and> (threada = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)\<rbrakk> \<Longrightarrow> ?Q446 a b threada x51 x52 x53 s
 3. \<And>a b threada x51 x52 x53 s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3); \<not> x52; invs' s \<and> cte_wp_at' (\<lambda>c. weak_derived' (capability.ReplyCap x51 False (AllowGrant \<in> x53)) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s\<rbrakk> \<Longrightarrow> ?Q'446 a b threada x51 x52 x53 s
 4. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q430 prod thread\<rbrace> get_cap (thread, tcb_cnode_index 3) \<lbrace>\<lambda>cap s. (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod and valid_cap cap and K ((threada, tcb_cnode_index 3) \<noteq> prod)) s)\<rbrace>
 5. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. isReplyCap rv' \<and> \<not> capReplyMaster rv' \<longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' rv' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod)) s\<rbrace>
 6. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and ?Q430 prod thread\<rbrace>
 7. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 8. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 9. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 10. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (10 subgoals):
 1. \<And>a b threada x51 x52 x53. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3); \<not> x52\<rbrakk> \<Longrightarrow> cap_relation (cap.ReplyCap x51 False x53) (capability.ReplyCap x51 False (AllowGrant \<in> x53))
 2. \<And>a b threada x51 x52 x53 s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3); \<not> x52; invs s \<and> valid_list s \<and> valid_sched s \<and> cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> s \<turnstile> cap.ReplyCap x51 False x53 \<and> (threada = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and valid_cap (cap.ReplyCap x51 False x53) and tcb_cap_valid (cap.ReplyCap x51 False x53) (a, b) and K ((threada, tcb_cnode_index 3) \<noteq> (a, b))) s
 3. \<And>a b threada x51 x52 x53 s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3); \<not> x52; invs' s \<and> cte_wp_at' (\<lambda>c. weak_derived' (capability.ReplyCap x51 False (AllowGrant \<in> x53)) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' (capability.ReplyCap x51 False (AllowGrant \<in> x53)) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b))) s
 4. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q430 prod thread\<rbrace> get_cap (thread, tcb_cnode_index 3) \<lbrace>\<lambda>cap s. (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod and valid_cap cap and K ((threada, tcb_cnode_index 3) \<noteq> prod)) s)\<rbrace>
 5. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. isReplyCap rv' \<and> \<not> capReplyMaster rv' \<longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' rv' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod)) s\<rbrace>
 6. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and ?Q430 prod thread\<rbrace>
 7. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 8. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 9. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 10. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q430 prod threada\<rbrace> get_cap (threada, tcb_cnode_index 3) \<lbrace>\<lambda>cap s. (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> cte_wp_at (\<lambda>_. True) (threada, tcb_cnode_index 3) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) prod s \<and> real_cte_at prod s \<and> s \<turnstile> cap \<and> (threada, tcb_cnode_index 3) \<noteq> prod)\<rbrace>
 2. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. isReplyCap rv' \<and> \<not> capReplyMaster rv' \<longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' rv' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod)) s\<rbrace>
 3. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and ?Q430 prod thread\<rbrace>
 4. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 5. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 6. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; thread + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (thread, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> getSlotCap (threada + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. isReplyCap rv' \<and> \<not> capReplyMaster rv' \<longrightarrow> (invs' and cte_wp_at' (\<lambda>c. weak_derived' rv' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod)) s\<rbrace>
 2. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) (thread, tcb_cnode_index 3) s \<longrightarrow> (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) prod s \<and> real_cte_at prod s \<and> s \<turnstile> cap \<and> (thread, tcb_cnode_index 3) \<noteq> prod))\<rbrace>
 3. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 4. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 5. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (6 subgoals):
 1. \<And>prod thread threada. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; thread = threada; threada + 2 ^ cte_level_bits * tcbCallerSlot = cte_map (threada, tcb_cnode_index 3)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 prod threada\<rbrace> do cte <- getCTE (cte_map (threada, tcb_cnode_index 3));
return (cteCap cte)
od \<lbrace>\<lambda>rv' s. isReplyCap rv' \<and> \<not> capReplyMaster rv' \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>c. weak_derived' rv' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (threada, tcb_cnode_index 3)) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) s\<rbrace>
 2. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q422 prod\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) (thread, tcb_cnode_index 3) s \<longrightarrow> (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> cte_wp_at (\<lambda>_. True) (thread, tcb_cnode_index 3) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) prod s \<and> real_cte_at prod s \<and> s \<turnstile> cap \<and> (thread, tcb_cnode_index 3) \<noteq> prod))\<rbrace>
 3. \<And>prod. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod\<rbrakk> \<Longrightarrow> \<lbrace>?Q'422 prod\<rbrace> getCurThread \<lbrace>\<lambda>threada. pspace_distinct' and pspace_aligned' and ?Q'431 prod threada\<rbrace>
 4. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q422 prod) s
 5. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'422 prod) s
 6. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (einvs and simple_sched_action and (ex_cte_cap_wp_to is_cnode_cap prod and cte_wp_at (\<lambda>c. c = cap.NullCap) prod and real_cte_at prod)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (cte_wp_at (\<lambda>_. True) (cur_thread s, tcb_cnode_index 3) and (\<lambda>sa. \<forall>cap. cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) sa \<longrightarrow> (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> invs sa \<and> valid_list sa \<and> valid_sched sa \<and> cte_wp_at (\<lambda>_. True) (cur_thread s, tcb_cnode_index 3) sa \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) prod sa \<and> real_cte_at prod sa \<and> sa \<turnstile> cap \<and> (cur_thread s, tcb_cnode_index 3) \<noteq> prod))) s)) s
 2. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (cur_thread s, tcb_cnode_index 3) s \<and> (\<forall>cap. cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s \<longrightarrow> (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> cte_wp_at (\<lambda>_. True) (cur_thread s, tcb_cnode_index 3) s \<and> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)))
 2. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (cur_thread s, tcb_cnode_index 3) s
 2. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s \<longrightarrow> (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> cte_wp_at (\<lambda>_. True) (cur_thread s, tcb_cnode_index 3) s \<and> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b))
 3. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (5 subgoals):
 1. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s\<rbrakk> \<Longrightarrow> tcb_at (cur_thread s) s
 2. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s\<rbrakk> \<Longrightarrow> tcb_cnode_index 3 \<in> dom tcb_cap_cases
 3. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s \<longrightarrow> (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> cte_wp_at (\<lambda>_. True) (cur_thread s, tcb_cnode_index 3) s \<and> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b))
 4. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 5. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s\<rbrakk> \<Longrightarrow> tcb_cnode_index 3 \<in> dom tcb_cap_cases
 2. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s \<longrightarrow> (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> cte_wp_at (\<lambda>_. True) (cur_thread s, tcb_cnode_index 3) s \<and> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b))
 3. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s \<longrightarrow> (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> cte_wp_at (\<lambda>_. True) (cur_thread s, tcb_cnode_index 3) s \<and> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b))
 2. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> (is_reply_cap cap \<or> cap = cap.NullCap) \<and> (is_reply_cap cap \<longrightarrow> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b))
 2. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> is_reply_cap cap \<or> cap = cap.NullCap
 2. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> is_reply_cap cap \<longrightarrow> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)
 3. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s; tcb_at (cur_thread s) s\<rbrakk> \<Longrightarrow> is_reply_cap cap \<or> cap = cap.NullCap
 2. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> is_reply_cap cap \<longrightarrow> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)
 3. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (7 subgoals):
 1. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s; tcb_at (cur_thread s) s\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s; tcb_at (cur_thread s) s\<rbrakk> \<Longrightarrow> tcb_cnode_index 3 \<in> dom tcb_cap_cases
 3. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s; tcb_at (cur_thread s) s\<rbrakk> \<Longrightarrow> \<forall>cap st getF setF restr. tcb_cap_cases (tcb_cnode_index 3) = Some (getF, setF, restr) \<and> restr (cur_thread s) st cap \<longrightarrow> (is_reply_cap or (=) cap.NullCap) cap
 4. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s; tcb_at (cur_thread s) s; cte_wp_at (is_reply_cap or (=) cap.NullCap) (cur_thread s, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> is_reply_cap cap \<or> cap = cap.NullCap
 5. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> is_reply_cap cap \<longrightarrow> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)
 6. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 7. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (4 subgoals):
 1. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s; tcb_at (cur_thread s) s; cte_wp_at (is_reply_cap or (=) cap.NullCap) (cur_thread s, tcb_cnode_index 3) s; cap \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> is_reply_cap cap
 2. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> is_reply_cap cap \<longrightarrow> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)
 3. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 4. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> is_reply_cap cap \<longrightarrow> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)
 2. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s; is_reply_cap cap\<rbrakk> \<Longrightarrow> s \<turnstile> cap \<and> (cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b)
 2. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (3 subgoals):
 1. \<And>a b s cap. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs s; valid_list s; valid_sched s; simple_sched_action s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cte_wp_at ((=) cap) (cur_thread s, tcb_cnode_index 3) s; is_reply_cap cap\<rbrakk> \<Longrightarrow> cur_thread s = a \<longrightarrow> tcb_cnode_index 3 \<noteq> b
 2. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 3. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (2 subgoals):
 1. \<And>prod s. \<lbrakk>ci' = SaveCaller (cte_map prod); ci = SaveCall prod; (invs' and sch_act_simple and (ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map prod) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod))) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_distinct' and pspace_aligned' and (\<lambda>sa. cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map prod) sa)))) s)) s
 2. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (2 subgoals):
 1. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s\<rbrakk> \<Longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) s \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) s)))
 2. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (2 subgoals):
 1. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) s \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) s)))
 2. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (2 subgoals):
 1. \<And>a b s. \<lbrakk>ci' = SaveCaller (cte_map (a, b)); ci = SaveCall (a, b); invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (ksCurThread s, tcb_cnode_index 3)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (ksCurThread s, tcb_cnode_index 3)) s \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map (ksCurThread s, tcb_cnode_index 3)) s))
 2. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (1 subgoal):
 1. \<And>x7. \<lbrakk>\<exists>c'. cap_relation x7 c' \<and> ci' = CancelBadgedSends c'; ci = CancelBadgedSendsCall x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and valid_cnode_inv' ci') (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case ci' of Insert cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteInsert cap srcSlot destSlot | Rotate cap1 cap2 slot1 slot2 slot3 \<Rightarrow> withoutPreemption $ if slot1 = slot3 then cteSwap cap1 slot1 cap2 slot2 else do cteMove cap2 slot2 slot3;
cteMove cap1 slot1 slot2
od | Revoke destSlot \<Rightarrow> cteRevoke destSlot | Move cap srcSlot destSlot \<Rightarrow> withoutPreemption $ cteMove cap srcSlot destSlot | CancelBadgedSends (capability.EndpointCap ptr b xa xaa xb xc) \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | CancelBadgedSends _ \<Rightarrow> haskell_fail [] | SaveCaller destSlot \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
srcSlot <- getThreadCallerSlot thread;
cap <- getSlotCap srcSlot;
case cap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap x True xa \<Rightarrow> haskell_fail [] | capability.ReplyCap x False xa \<Rightarrow> cteMove cap srcSlot destSlot | _ \<Rightarrow> haskell_fail []
od | Delete destSlot \<Rightarrow> cteDelete destSlot True) proof (prove)
goal (1 subgoal):
 1. \<And>x7 c'. \<lbrakk>ci = CancelBadgedSendsCall x7; cap_relation x7 c'; ci' = CancelBadgedSends c'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>y. hasCancelSendRights c'))) (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case c' of capability.EndpointCap ptr b x xa xb xc \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | _ \<Rightarrow> haskell_fail []) proof (prove)
goal (2 subgoals):
 1. \<And>x7 c'. \<lbrakk>ci = CancelBadgedSendsCall x7; cap_relation x7 c'; ci' = CancelBadgedSends c'; has_cancel_send_rights x7; \<exists>r b R. x7 = cap.EndpointCap r b R\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and valid_cap x7) (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>y. hasCancelSendRights c'))) (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case c' of capability.EndpointCap ptr b x xa xb xc \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | _ \<Rightarrow> haskell_fail [])
 2. \<And>x7 c'. \<lbrakk>ci = CancelBadgedSendsCall x7; cap_relation x7 c'; ci' = CancelBadgedSends c'; \<not> has_cancel_send_rights x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>y. hasCancelSendRights c'))) (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case c' of capability.EndpointCap ptr b x xa xb xc \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | _ \<Rightarrow> haskell_fail []) proof (prove)
goal (2 subgoals):
 1. \<And>r b R. \<lbrakk>ci = CancelBadgedSendsCall (cap.EndpointCap r b R); ci' = CancelBadgedSends (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)); has_cancel_send_rights (cap.EndpointCap r b R); b \<noteq> 0\<rbrakk> \<Longrightarrow> corres dc (einvs and simple_sched_action and valid_cap (cap.EndpointCap r b R)) (invs' and sch_act_simple and (valid_cap' (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)) and (\<lambda>y. hasCancelSendRights (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R))))) (cancel_badged_sends r b) (cancelBadgedSends r b)
 2. \<And>x7 c'. \<lbrakk>ci = CancelBadgedSendsCall x7; cap_relation x7 c'; ci' = CancelBadgedSends c'; \<not> has_cancel_send_rights x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>y. hasCancelSendRights c'))) (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case c' of capability.EndpointCap ptr b x xa xb xc \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | _ \<Rightarrow> haskell_fail []) proof (prove)
goal (4 subgoals):
 1. \<And>r b R. \<lbrakk>ci = CancelBadgedSendsCall (cap.EndpointCap r b R); ci' = CancelBadgedSends (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)); has_cancel_send_rights (cap.EndpointCap r b R); b \<noteq> 0\<rbrakk> \<Longrightarrow> corres dc (?Q612 r b R) (?Q'612 r b R) (cancel_badged_sends r b) (cancelBadgedSends r b)
 2. \<And>r b R s. \<lbrakk>ci = CancelBadgedSendsCall (cap.EndpointCap r b R); ci' = CancelBadgedSends (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)); has_cancel_send_rights (cap.EndpointCap r b R); b \<noteq> 0; (einvs and simple_sched_action and valid_cap (cap.EndpointCap r b R)) s\<rbrakk> \<Longrightarrow> ?Q612 r b R s
 3. \<And>r b R s. \<lbrakk>ci = CancelBadgedSendsCall (cap.EndpointCap r b R); ci' = CancelBadgedSends (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)); has_cancel_send_rights (cap.EndpointCap r b R); b \<noteq> 0; (invs' and sch_act_simple and (valid_cap' (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)) and (\<lambda>y. hasCancelSendRights (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R))))) s\<rbrakk> \<Longrightarrow> ?Q'612 r b R s
 4. \<And>x7 c'. \<lbrakk>ci = CancelBadgedSendsCall x7; cap_relation x7 c'; ci' = CancelBadgedSends c'; \<not> has_cancel_send_rights x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>y. hasCancelSendRights c'))) (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case c' of capability.EndpointCap ptr b x xa xb xc \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | _ \<Rightarrow> haskell_fail []) proof (prove)
goal (3 subgoals):
 1. \<And>r b R s. \<lbrakk>ci = CancelBadgedSendsCall (cap.EndpointCap r b R); ci' = CancelBadgedSends (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)); has_cancel_send_rights (cap.EndpointCap r b R); b \<noteq> 0; (einvs and simple_sched_action and valid_cap (cap.EndpointCap r b R)) s\<rbrakk> \<Longrightarrow> (invs and valid_sched and ep_at r) s
 2. \<And>r b R s. \<lbrakk>ci = CancelBadgedSendsCall (cap.EndpointCap r b R); ci' = CancelBadgedSends (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)); has_cancel_send_rights (cap.EndpointCap r b R); b \<noteq> 0; (invs' and sch_act_simple and (valid_cap' (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)) and (\<lambda>y. hasCancelSendRights (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R))))) s\<rbrakk> \<Longrightarrow> (invs' and ep_at' r) s
 3. \<And>x7 c'. \<lbrakk>ci = CancelBadgedSendsCall x7; cap_relation x7 c'; ci' = CancelBadgedSends c'; \<not> has_cancel_send_rights x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>y. hasCancelSendRights c'))) (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case c' of capability.EndpointCap ptr b x xa xb xc \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | _ \<Rightarrow> haskell_fail []) proof (prove)
goal (2 subgoals):
 1. \<And>r b R s. \<lbrakk>ci = CancelBadgedSendsCall (cap.EndpointCap r b R); ci' = CancelBadgedSends (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)); has_cancel_send_rights (cap.EndpointCap r b R); b \<noteq> 0; (invs' and sch_act_simple and (valid_cap' (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R)) and (\<lambda>y. hasCancelSendRights (capability.EndpointCap r b (AllowWrite \<in> R) (AllowRead \<in> R) (AllowGrant \<in> R) (AllowGrantReply \<in> R))))) s\<rbrakk> \<Longrightarrow> (invs' and ep_at' r) s
 2. \<And>x7 c'. \<lbrakk>ci = CancelBadgedSendsCall x7; cap_relation x7 c'; ci' = CancelBadgedSends c'; \<not> has_cancel_send_rights x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>y. hasCancelSendRights c'))) (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case c' of capability.EndpointCap ptr b x xa xb xc \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | _ \<Rightarrow> haskell_fail []) proof (prove)
goal (1 subgoal):
 1. \<And>x7 c'. \<lbrakk>ci = CancelBadgedSendsCall x7; cap_relation x7 c'; ci' = CancelBadgedSends c'; \<not> has_cancel_send_rights x7\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and (valid_cap x7 and (\<lambda>y. has_cancel_send_rights x7))) (invs' and sch_act_simple and (valid_cap' c' and (\<lambda>y. hasCancelSendRights c'))) (case x7 of cap.EndpointCap ep b R \<Rightarrow> without_preemption $ when (b \<noteq> 0) $ cancel_badged_sends ep b | _ \<Rightarrow> fail) (case c' of capability.EndpointCap ptr b x xa xb xc \<Rightarrow> withoutPreemption $ unless (b = 0) $ cancelBadgedSends ptr b | _ \<Rightarrow> haskell_fail []) proof (prove)
goal:
No subgoals!