theory Syscall_C

lemma handleReply_ccorres:
  "ccorres dc xfdc
       (\<lambda>s. invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s)
       UNIV
       []
       (handleReply)
       (Call handleReply_'proc)" apply cinit apply (rule ccorres_pre_getCurThread) apply (simp only: getThreadCallerSlot_def locateSlot_conv) apply (rule_tac P="\<lambda>s. thread=ksCurThread s \<and> invs' s \<and> is_aligned thread tcbBlockSizeBits"
                   and r'="\<lambda> a c. c = cte_Ptr a"
                   and xf'="callerSlot_'" and P'=UNIV in ccorres_split_nothrow) apply (rule ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def word_sle_def) apply (frule is_aligned_neg_mask_eq) apply (frule tcb_at_invs') apply (simp add: mask_def tcbCallerSlot_def
              cte_level_bits_def size_of_def
              ptr_add_assertion_positive
              tcb_cnode_index_defs rf_sr_ksCurThread
              rf_sr_tcb_ctes_array_assertion2[THEN array_assertion_shrink_right]) apply ceqv apply (simp del: Collect_const) apply (rule ccorres_getSlotCap_cte_at) apply (rule ccorres_move_c_guard_cte) apply ctac apply (wpc, simp_all) apply (rule ccorres_fail) apply (simp add: ccap_relation_NullCap_iff cap_tag_defs) apply (rule ccorres_split_throws) apply (rule ccorres_Catch) apply csymbr apply (rule ccorres_cond_false) apply (rule ccorres_cond_true) apply simp apply (rule ccorres_return_void_catchbrk) apply (rule ccorres_return_void_C) apply (vcg exspec=doReplyTransfer_modifies) apply (rule ccorres_fail)+ apply (wpc, simp_all) apply (rule ccorres_fail) apply (rule ccorres_split_throws) apply (rule ccorres_Catch) apply csymbr apply (rule ccorres_cond_true) apply (frule cap_get_tag_isCap_unfolded_H_cap(8)) apply simp apply (rule ccorres_rhs_assoc)+ apply csymbr+ apply (frule cap_get_tag_ReplyCap) apply (clarsimp simp: to_bool_def) apply (csymbr, csymbr, csymbr) apply simp apply (rule ccorres_assert2) apply (rule ccorres_add_return2) apply (ctac (no_vcg)) apply (rule ccorres_return_void_catchbrk) apply (rule ccorres_return_void_C) apply wp apply (vcg exspec=doReplyTransfer_modifies) apply (rule ccorres_fail)+ apply simp_all apply (simp add: getSlotCap_def) apply (wp getCTE_wp')[1] apply vcg apply wp apply vcg apply clarsimp apply (intro allI conjI impI,
        simp_all add: cap_get_tag_isCap_unfolded_H_cap cap_tag_defs) apply (rule tcb_aligned', rule tcb_at_invs', simp) apply (auto simp: cte_wp_at_ctes_of valid_cap'_def
                     dest!: ctes_of_valid')[1] apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps) apply (simp add: real_cte_tcbCallerSlot[OF pred_tcb_at']) apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps) apply (fastforce simp: ccap_relation_reply_helpers cap_get_tag_isCap isCap_simps)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s) UNIV [] handleReply (Call handleReply_'proc) proof (prove)
goal (2 subgoals):
 1. ccorres dc xfdc ?Q513 ?Q'513 [SKIP] (do thread <- getCurThread;
callerSlot <- getThreadCallerSlot thread;
callerCap <- getSlotCap callerSlot;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller callerSlot canGrant
od | _ \<Rightarrow> haskell_fail []
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q513 s \<and> s' \<in> ?Q'513 proof (prove)
goal (2 subgoals):
 1. \<And>thread. ccorres dc xfdc (?P519 thread) (?P'519 thread) [SKIP] (do callerSlot <- getThreadCallerSlot thread;
callerCap <- getSlotCap callerSlot;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller callerSlot canGrant
od | _ \<Rightarrow> haskell_fail []
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P519 rv s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'519 rv} proof (prove)
goal (2 subgoals):
 1. \<And>thread. ccorres dc xfdc (?P519 thread) (?P'519 thread) [SKIP] (do callerSlot <- return (thread + 2 ^ cte_level_bits * tcbCallerSlot);
callerCap <- getSlotCap callerSlot;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller callerSlot canGrant
od | _ \<Rightarrow> haskell_fail []
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P519 rv s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'519 rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread. ccorres (\<lambda>a c. c = cte_Ptr a) callerSlot_' (\<lambda>s. thread = ksCurThread s \<and> invs' s \<and> is_aligned thread tcbBlockSizeBits) UNIV [SKIP] (return (thread + 2 ^ cte_level_bits * tcbCallerSlot)) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))))
 2. \<And>thread rv' t t'. ceqv \<Gamma> callerSlot_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)) (?d'521 thread rv')
 3. \<And>thread rv rv'. rv' = cte_Ptr rv \<Longrightarrow> ccorres dc xfdc (?Q521 thread rv) (?Q'521 thread rv rv') [SKIP] (do callerCap <- getSlotCap rv;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> haskell_fail []
od) (?d'521 thread rv')
 4. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q521 thread\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (thread = ksCurThread \<sigma> \<and> invs' \<sigma> \<and> is_aligned thread tcbBlockSizeBits) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<exists>(rv, \<sigma>')\<in>fst (return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> callerSlot_' s = cte_Ptr rv}
 2. \<And>thread rv' t t'. ceqv \<Gamma> callerSlot_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)) (?d'521 thread rv')
 3. \<And>thread rv rv'. rv' = cte_Ptr rv \<Longrightarrow> ccorres dc xfdc (?Q521 thread rv) (?Q'521 thread rv rv') [SKIP] (do callerCap <- getSlotCap rv;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> haskell_fail []
od) (?d'521 thread rv')
 4. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q521 thread\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread \<sigma>. {s. (thread = ksCurThread \<sigma> \<and> invs' \<sigma> \<and> is_aligned thread tcbBlockSizeBits) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. ptr_add_assertion (cte_Ptr (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s))) \<and> (\<exists>(rv, \<sigma>')\<in>fst (return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<sigma>). (\<sigma>', callerSlot_'_update (\<lambda>_. cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) s) \<in> rf_sr \<and> cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr rv)}
 2. \<And>thread rv' t t'. ceqv \<Gamma> callerSlot_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)) (?d'521 thread rv')
 3. \<And>thread rv rv'. rv' = cte_Ptr rv \<Longrightarrow> ccorres dc xfdc (?Q521 thread rv) (?Q'521 thread rv rv') [SKIP] (do callerCap <- getSlotCap rv;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> haskell_fail []
od) (?d'521 thread rv')
 4. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q521 thread\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; is_aligned (ksCurThread \<sigma>) tcbBlockSizeBits; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (ptr_val (ksCurThread_' (globals x)) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals x))) \<and> (ptr_val (ksCurThread_' (globals x)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)) = ksCurThread \<sigma> + 2 ^ cte_level_bits * tcbCallerSlot
 2. \<And>thread rv' t t'. ceqv \<Gamma> callerSlot_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)) (?d'521 thread rv')
 3. \<And>thread rv rv'. rv' = cte_Ptr rv \<Longrightarrow> ccorres dc xfdc (?Q521 thread rv) (?Q'521 thread rv rv') [SKIP] (do callerCap <- getSlotCap rv;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> haskell_fail []
od) (?d'521 thread rv')
 4. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q521 thread\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; is_aligned (ksCurThread \<sigma>) tcbBlockSizeBits; (\<sigma>, x) \<in> rf_sr; ksCurThread \<sigma> && ~~ mask tcbBlockSizeBits = ksCurThread \<sigma>\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (ptr_val (ksCurThread_' (globals x)) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals x))) \<and> (ptr_val (ksCurThread_' (globals x)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)) = ksCurThread \<sigma> + 2 ^ cte_level_bits * tcbCallerSlot
 2. \<And>thread rv' t t'. ceqv \<Gamma> callerSlot_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)) (?d'521 thread rv')
 3. \<And>thread rv rv'. rv' = cte_Ptr rv \<Longrightarrow> ccorres dc xfdc (?Q521 thread rv) (?Q'521 thread rv rv') [SKIP] (do callerCap <- getSlotCap rv;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> haskell_fail []
od) (?d'521 thread rv')
 4. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q521 thread\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; is_aligned (ksCurThread \<sigma>) tcbBlockSizeBits; (\<sigma>, x) \<in> rf_sr; ksCurThread \<sigma> && ~~ mask tcbBlockSizeBits = ksCurThread \<sigma>; tcb_at' (ksCurThread \<sigma>) \<sigma>\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (ptr_val (ksCurThread_' (globals x)) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals x))) \<and> (ptr_val (ksCurThread_' (globals x)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)) = ksCurThread \<sigma> + 2 ^ cte_level_bits * tcbCallerSlot
 2. \<And>thread rv' t t'. ceqv \<Gamma> callerSlot_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)) (?d'521 thread rv')
 3. \<And>thread rv rv'. rv' = cte_Ptr rv \<Longrightarrow> ccorres dc xfdc (?Q521 thread rv) (?Q'521 thread rv rv') [SKIP] (do callerCap <- getSlotCap rv;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> haskell_fail []
od) (?d'521 thread rv')
 4. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q521 thread\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (5 subgoals):
 1. \<And>thread rv' t t'. ceqv \<Gamma> callerSlot_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,\<acute>callerSlot,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)) (?d'521 thread rv')
 2. \<And>thread rv rv'. rv' = cte_Ptr rv \<Longrightarrow> ccorres dc xfdc (?Q521 thread rv) (?Q'521 thread rv rv') [SKIP] (do callerCap <- getSlotCap rv;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> haskell_fail []
od) (?d'521 thread rv')
 3. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q521 thread\<rbrace>
 4. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (4 subgoals):
 1. \<And>thread rv rv'. rv' = cte_Ptr rv \<Longrightarrow> ccorres dc xfdc (?Q521 thread rv) (?Q'521 thread rv rv') [SKIP] (do callerCap <- getSlotCap rv;
case callerCap of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> haskell_fail []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(rv'\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,rv',UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP))
 2. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q521 thread\<rbrace>
 3. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (4 subgoals):
 1. \<And>thread rv. ccorres dc xfdc (?Q521 thread rv) (?Q'521 thread rv (cte_Ptr rv)) [SKIP] (getSlotCap rv >>= case_capability (\<lambda>word. fail) (return ()) (\<lambda>word1 word2 bool1 bool2. fail) (\<lambda>word. fail) (\<lambda>word1 word2 bool1 bool2 bool3 bool4. fail) fail (\<lambda>word zombie_type nat. fail) (\<lambda>arch_capability. fail) (\<lambda>caller bool1 canGrant. case bool1 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od) (\<lambda>bool word nat1 nat2. fail) (\<lambda>word1 nat1 word2 nat2. fail) fail) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP))
 2. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q521 thread\<rbrace>
 3. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (4 subgoals):
 1. \<And>thread rv. ccorres dc xfdc (?G840 thread rv) (?Q'521 thread rv (cte_Ptr rv)) [SKIP] (do a <- getSlotCap rv;
case a of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller bool1 canGrant \<Rightarrow> case bool1 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> fail
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP))
 2. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?G840 thread rv s\<rbrace>
 3. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'521 thread rv (callerSlot_' s)}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (4 subgoals):
 1. \<And>thread rv. ccorres dc xfdc (?A842 thread rv) (?C'843 thread rv (cte_Ptr rv)) [SKIP] (do a <- getSlotCap rv;
case a of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller bool1 canGrant \<Rightarrow> case bool1 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> fail
od) (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']));;
(TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(\<acute>callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(\<acute>callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP))
 2. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (?A842 thread rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr rv))) s\<rbrace>
 3. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?C'843 thread rv (callerSlot_' s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread rv rva callerCap. ccap_relation rva callerCap \<Longrightarrow> ccorres dc xfdc (?Q847 thread rv rva) (?Q'847 thread rv rva callerCap) [SKIP] (case rva of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller rv canGrant
od | _ \<Rightarrow> fail) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 2. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>?Q847 thread rv\<rbrace>
 3. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> s \<in> ?Q'847 thread rv rva (callerCap_' s)}
 4. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ((\<lambda>_. True) and ?R847 thread rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr rv))) s\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>callerSlot = \<^bsup>s\<^esup>callerSlot\<rbrace> \<inter> ?R'850 thread rv (callerSlot_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> invs' s \<and> is_aligned rv tcbBlockSizeBits) and ?R521 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> ?R'521 rv} proof (prove)
goal (17 subgoals):
 1. \<And>thread rv rva callerCap x1. \<lbrakk>ccap_relation (capability.ThreadCap x1) callerCap; rva = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1187 thread rv (capability.ThreadCap x1) x1) (?R''1185 thread rv (capability.ThreadCap x1) callerCap x1) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 2. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.NullCap callerCap; rva = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?R''1183 thread rv capability.NullCap callerCap) [SKIP] (return ()) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.NullCap callerCap; rva = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?R''1183 thread rv capability.NullCap callerCap) [SKIP] (return ()) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 2. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?R''1183 thread rv capability.NullCap callerCap) [SKIP] (return ()) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 2. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?P'1213 thread rv capability.NullCap callerCap) [SKIP] (return ()) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END)
 2. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1212 thread rv capability.NullCap callerCap) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?P'1213 thread rv capability.NullCap callerCap) [catchbrk_C, SKIP] (return ()) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI)
 2. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1212 thread rv capability.NullCap callerCap) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread rv rva callerCap ret__unsigned. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap; ret__unsigned = cap_get_tag callerCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?G'1234 thread rv capability.NullCap callerCap ret__unsigned) [catchbrk_C, SKIP] (return ()) (IF ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF ret__unsigned = 0 THEN
  return_void_C
FI
FI)
 2. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1212 thread rv capability.NullCap callerCap) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread rv rva callerCap ret__unsigned. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap; ret__unsigned = cap_get_tag callerCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?R'1404 thread rv capability.NullCap callerCap ret__unsigned) [catchbrk_C, SKIP] (return ()) (IF ret__unsigned = 0 THEN
  return_void_C
FI)
 2. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1212 thread rv capability.NullCap callerCap) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread rv rva callerCap ret__unsigned. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap; ret__unsigned = cap_get_tag callerCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?R'1409 thread rv capability.NullCap callerCap ret__unsigned) [catchbrk_C, SKIP] (return ()) return_void_C
 2. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1212 thread rv capability.NullCap callerCap) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread rv rva callerCap ret__unsigned. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap; ret__unsigned = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?R'1409 thread rv capability.NullCap callerCap 0) [catchbrk_C, SKIP] (return ()) return_void_C
 2. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1212 thread rv capability.NullCap callerCap) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread rv rva callerCap ret__unsigned. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap; ret__unsigned = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1188 thread rv capability.NullCap) (?R'1409 thread rv capability.NullCap callerCap 0) [SKIP] (return ()) return_void_C
 2. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1212 thread rv capability.NullCap callerCap) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread rv rva callerCap. \<lbrakk>cap_get_tag callerCap = 0; rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1212 thread rv capability.NullCap callerCap) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = 8 THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = 0 THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 2. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread rv rva callerCap x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) callerCap; rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1189 thread rv (capability.NotificationCap x31 x32 x33 x34) x31 x32 x33 x34) (?R''1182 thread rv (capability.NotificationCap x31 x32 x33 x34) callerCap x31 x32 x33 x34) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 2. \<And>thread rv rva callerCap x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) callerCap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1190 thread rv (capability.IRQHandlerCap x4) x4) (?R''1177 thread rv (capability.IRQHandlerCap x4) callerCap x4) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1191 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) x51 x52 x53 x54 x55 x56) (?R''1175 thread rv (capability.EndpointCap x51 x52 x53 x54 x55 x56) callerCap x51 x52 x53 x54 x55 x56) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.DomainCap callerCap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1192 thread rv capability.DomainCap) (?R''1168 thread rv capability.DomainCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) callerCap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1193 thread rv (capability.Zombie x71 x72 x73) x71 x72 x73) (?R''1167 thread rv (capability.Zombie x71 x72 x73) callerCap x71 x72 x73) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) callerCap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1194 thread rv (capability.ArchObjectCap x8) x8) (?R''1163 thread rv (capability.ArchObjectCap x8) callerCap x8) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 8. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 9. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 10. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
A total of 15 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) callerCap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1195 thread rv (capability.ReplyCap x91 x92 x93) x91 x92 x93) (?R''1161 thread rv (capability.ReplyCap x91 x92 x93) callerCap x91 x92 x93) [SKIP] (case x92 of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (x91 \<noteq> thread) [];
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 2. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x. rva = capability.ThreadCap x \<longrightarrow> True) \<and> (rva = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. rva = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. rva = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. rva = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (rva = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. rva = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. rva = capability.ArchObjectCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> ?R1195 thread rv (capability.ReplyCap x xa xb) x xa xb s) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 6. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (\<forall>x. rva = capability.ThreadCap x \<longrightarrow> s \<in> UNIV) \<and> (rva = capability.NullCap \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>v = 0\<rbrace> \<inter> - \<lbrace>v = 8\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<^bsup>s\<^esup>callerCap \<longrightarrow> (cap_get_tag \<^bsup>s\<^esup>callerCap = 8 \<longrightarrow> 8 = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) = 0 \<longrightarrow> 8 = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) \<longrightarrow> 8 = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) \<longrightarrow> Return \<noteq> Break))))) \<and> (cap_get_tag \<^bsup>s\<^esup>callerCap \<noteq> 8 \<longrightarrow> (cap_get_tag \<^bsup>s\<^esup>callerCap = 0 \<longrightarrow> Return \<noteq> Break) \<and> cap_get_tag \<^bsup>s\<^esup>callerCap = 0)\<rbrace>) \<and> (\<forall>x xa xb xc. rva = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> UNIV) \<and> (\<forall>x. rva = capability.IRQHandlerCap x \<longrightarrow> s \<in> UNIV) \<and> (\<forall>x xa xb xc xd xe. rva = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> UNIV) \<and> (rva = capability.DomainCap \<longrightarrow> s \<in> UNIV) \<and> (\<forall>x xa xb. rva = capability.Zombie x xa xb \<longrightarrow> s \<in> UNIV) \<and> (\<forall>x. rva = capability.ArchObjectCap x \<longrightarrow> s \<in> UNIV) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''1161 thread rv (capability.ReplyCap x xa xb) (callerCap_' s) x xa xb) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 7. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 True x93) callerCap; rva = capability.ReplyCap x91 True x93; x92\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1571 thread rv (capability.ReplyCap x91 True x93) x91 True x93) (?R''1574 thread rv (capability.ReplyCap x91 True x93) callerCap x91 True x93) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?R''1572 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) [SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> ?R1571 thread rv (capability.ReplyCap x True xb) x True xb s) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> ?R''1574 thread rv (capability.ReplyCap x True xb) (callerCap_' s) x True xb) \<and> (\<not> xa \<longrightarrow> s \<in> ?R''1572 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (9 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?R''1572 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) [SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 2. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 6. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> ?R''1572 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 7. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?P'1601 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) [SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> ?P'1601 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?P'1601 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) [catchbrk_C, SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> ?P'1601 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93 ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92; ret__unsigned = cap_get_tag callerCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?G'1622 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93 ret__unsigned) [catchbrk_C, SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1622 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93 ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92; ret__unsigned = cap_get_tag callerCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?R'1793 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93 ret__unsigned) [catchbrk_C, SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?R'1793 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93 ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92; ret__unsigned = cap_get_tag callerCap; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?R'1793 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93 ret__unsigned) [catchbrk_C, SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?R'1793 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93 ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92; ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?R'1793 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93 (SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) [catchbrk_C, SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?R'1793 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93 ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92; ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?R'1793 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93 (SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) [catchbrk_C, SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (lvar_nondet_init caller_' caller_'_update;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
(IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
(CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C)))))))
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?R'1793 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93 ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift callerCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?G'1854 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93 (SCAST(32 signed \<rightarrow> 32) cap_reply_cap) ret__unsigned) [catchbrk_C, SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (IF ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
(CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C)))))
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'1854 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v va}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93 ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift callerCap); (cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) = (capability.ReplyCap x91 False x93 = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift callerCap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift callerCap))))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap x91 False x93) x91 False x93) (?G'1854 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93 (SCAST(32 signed \<rightarrow> 32) cap_reply_cap) ret__unsigned) [catchbrk_C, SKIP] (do a <- assert (x91 \<noteq> thread);
doReplyTransfer thread x91 rv x93
od) (IF ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
(CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C)))))
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'1854 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v va}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv callerCap x92. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (?G'1854 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) (SCAST(32 signed \<rightarrow> 32) cap_reply_cap) 0) [catchbrk_C, SKIP] (do a <- assert (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread);
doReplyTransfer thread (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) rv (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)
od) (\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
(CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C))))
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'1854 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v va}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv callerCap x92 ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigneda = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap); ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift callerCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (?G'2140 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) (SCAST(32 signed \<rightarrow> 32) cap_reply_cap) 0 ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- assert (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread);
doReplyTransfer thread (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) rv (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)
od) (CALL doReplyTransfer_'proc(\<acute>ksCurThread,tcb_Ptr ret__unsigneda,cte_Ptr rv,ret__unsigned);;
return_void_C)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> ?G'2140 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v va vb vc}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv callerCap x92 ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigneda = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap); ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift callerCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1570 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (?G'2140 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) (SCAST(32 signed \<rightarrow> 32) cap_reply_cap) 0 (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)) (capReplyCanGrant_CL (cap_reply_cap_lift callerCap))) [catchbrk_C, SKIP] (do a <- assert (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread);
doReplyTransfer thread (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) rv (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)
od) (CALL doReplyTransfer_'proc(\<acute>ksCurThread,tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)),cte_Ptr rv,capReplyCanGrant_CL (cap_reply_cap_lift callerCap));;
return_void_C)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> ?R1570 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> ?G'2140 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v va vb vc}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv callerCap x92 ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigneda = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap); ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift callerCap); ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G2199 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (?G'2200 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) (SCAST(32 signed \<rightarrow> 32) cap_reply_cap) 0 (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)) (capReplyCanGrant_CL (cap_reply_cap_lift callerCap))) [catchbrk_C, SKIP] (doReplyTransfer thread (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) rv (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (CALL doReplyTransfer_'proc(\<acute>ksCurThread,tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)),cte_Ptr rv,capReplyCanGrant_CL (cap_reply_cap_lift callerCap));;
return_void_C)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> ?G2199 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. x \<noteq> thread \<longrightarrow> sa \<in> ?G'2200 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v va vb vc}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv callerCap x92 ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigneda = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap); ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift callerCap); ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G2199 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (?G'2200 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) (SCAST(32 signed \<rightarrow> 32) cap_reply_cap) 0 (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)) (capReplyCanGrant_CL (cap_reply_cap_lift callerCap))) [catchbrk_C, SKIP] (doReplyTransfer thread (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) rv (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) >>= return) (CALL doReplyTransfer_'proc(\<acute>ksCurThread,tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)),cte_Ptr rv,capReplyCanGrant_CL (cap_reply_cap_lift callerCap));;
return_void_C)
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> ?G2199 thread rv (capability.ReplyCap x False xb) x False xb s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. x \<noteq> thread \<longrightarrow> sa \<in> ?G'2200 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v va vb vc}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (11 subgoals):
 1. \<And>thread rv callerCap x92 ret__unsigneda ret__unsigned rva xfdca. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigneda = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap); ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift callerCap); ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2212 thread rv callerCap x92 ret__unsigneda ret__unsigned rva) (?Q'2226 thread rv callerCap rva xfdca) [catchbrk_C, SKIP] (return rva) return_void_C
 2. \<And>thread rv callerCap x92 ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigneda = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap); ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift callerCap); ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?R2220 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)\<rbrace> doReplyTransfer thread (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) rv (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) \<lbrace>?Q2212 thread rv callerCap x92 ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 4. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> (invs' and st_tcb_at' (Not \<circ> isReply) thread and tcb_at' x and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' rv or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv and ?R2220 thread rv (capability.ReplyCap x False xb) x False xb) s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 8. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. x \<noteq> thread \<longrightarrow> sa \<in> {s. grant_'_update (\<lambda>_. vc) (slot_'_update (\<lambda>_. cte_Ptr rv) (receiver_'_update (\<lambda>_. tcb_Ptr vb) (sender_'_update (\<lambda>_. ksCurThread_' (globals s)) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool xb\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2225 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v va vb vc t rva}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 9. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 10. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>thread rv callerCap t rva. ?Q'2226 thread rv callerCap rva (xfdc t) \<equiv>\<^sup>? \<lambda>thread rv callerCap. ?Q'2225 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) (SCAST(32 signed \<rightarrow> 32) cap_reply_cap) 0 (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)) (capReplyCanGrant_CL (cap_reply_cap_lift callerCap)) proof (prove)
goal (11 subgoals):
 1. \<And>thread rv callerCap x92 ret__unsigneda ret__unsigned rva xfdca. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigneda = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap); ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift callerCap); ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2212 thread rv callerCap x92 ret__unsigneda ret__unsigned rva) (?Q'2226 thread rv callerCap rva xfdca) [SKIP] (return rva) return_void_C
 2. \<And>thread rv callerCap x92 ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigneda = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap); ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift callerCap); ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?R2220 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)\<rbrace> doReplyTransfer thread (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) rv (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) \<lbrace>?Q2212 thread rv callerCap x92 ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 4. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 7. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> (invs' and st_tcb_at' (Not \<circ> isReply) thread and tcb_at' x and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' rv or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv and ?R2220 thread rv (capability.ReplyCap x False xb) x False xb) s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 8. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. x \<noteq> thread \<longrightarrow> sa \<in> {s. grant_'_update (\<lambda>_. vc) (slot_'_update (\<lambda>_. cte_Ptr rv) (receiver_'_update (\<lambda>_. tcb_Ptr vb) (sender_'_update (\<lambda>_. ksCurThread_' (globals s)) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool xb\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2225 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb v va vb vc t rva}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 9. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 10. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>thread rv callerCap t rva. ?Q'2226 thread rv callerCap rva (xfdc t) \<equiv>\<^sup>? \<lambda>thread rv callerCap. ?Q'2225 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) (SCAST(32 signed \<rightarrow> 32) cap_reply_cap) 0 (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)) (capReplyCanGrant_CL (cap_reply_cap_lift callerCap)) proof (prove)
goal (10 subgoals):
 1. \<And>thread rv callerCap x92 ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) callerCap; \<not> x92; capReplyMaster_CL (cap_reply_cap_lift callerCap) = 0; cap_get_tag callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ret__unsigneda = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap); ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift callerCap); ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap))) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?R2220 thread rv (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) False (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0)\<rbrace> doReplyTransfer thread (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift callerCap)))) rv (capReplyCanGrant_CL (cap_reply_cap_lift callerCap) \<noteq> 0) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 3. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 6. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> (invs' and st_tcb_at' (Not \<circ> isReply) thread and tcb_at' x and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' rv or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv and ?R2220 thread rv (capability.ReplyCap x False xb) x False xb) s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 7. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. x \<noteq> thread \<longrightarrow> s \<in> {s. grant_'_update (\<lambda>_. v) (slot_'_update (\<lambda>_. cte_Ptr rv) (receiver_'_update (\<lambda>_. tcb_Ptr va) (sender_'_update (\<lambda>_. ksCurThread_' (globals s)) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool xb\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 8. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (9 subgoals):
 1. \<And>thread rv rva callerCap x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 False x93) callerCap; rva = capability.ReplyCap x91 False x93; \<not> x92\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1600 thread rv (capability.ReplyCap x91 False x93) callerCap x91 False x93) TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END {},UNIV
 2. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 5. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> (invs' and st_tcb_at' (Not \<circ> isReply) thread and tcb_at' x and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' rv or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv and (\<lambda>a. True)) s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 6. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. x \<noteq> thread \<longrightarrow> s \<in> {s. grant_'_update (\<lambda>_. v) (slot_'_update (\<lambda>_. cte_Ptr rv) (receiver_'_update (\<lambda>_. tcb_Ptr va) (sender_'_update (\<lambda>_. ksCurThread_' (globals s)) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool xb\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> ?R'1600 thread rv (capability.ReplyCap x False xb) (callerCap_' s) x False xb)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 7. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (8 subgoals):
 1. \<And>thread rv rva callerCap x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) callerCap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1196 thread rv (capability.UntypedCap x101 x102 x103 x104) x101 x102 x103 x104) (?R''1157 thread rv (capability.UntypedCap x101 x102 x103 x104) callerCap x101 x102 x103 x104) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 2. \<And>thread rv rva callerCap x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) callerCap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1197 thread rv (capability.CNodeCap x111 x112 x113 x114) x111 x112 x113 x114) (?R''1152 thread rv (capability.CNodeCap x111 x112 x113 x114) callerCap x111 x112 x113 x114) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 3. \<And>thread rv rva callerCap. \<lbrakk>ccap_relation capability.IRQControlCap callerCap; rva = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1198 thread rv capability.IRQControlCap) (?R''1147 thread rv capability.IRQControlCap callerCap) [SKIP] fail (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(callerCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init caller_' caller_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(callerCap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(callerCap);;
\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(callerCap);;
CALL doReplyTransfer_'proc(\<acute>ksCurThread,\<acute>caller,cte_Ptr rv,\<acute>ret__unsigned);;
return_void_C
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_void_C
FI
FI
CATCH catchbrk_C
END;;
Guard DontReach {} SKIP)
 4. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> (invs' and st_tcb_at' (Not \<circ> isReply) thread and tcb_at' x and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' rv or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv and (\<lambda>a. True)) s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> ?R1196 thread rv (capability.UntypedCap x xa xb xc) x xa xb xc s) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> ?R1197 thread rv (capability.CNodeCap x xa xb xc) x xa xb xc s) \<and> (rva = capability.IRQControlCap \<longrightarrow> ?R1198 thread rv capability.IRQControlCap s)\<rbrace>
 5. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. x \<noteq> thread \<longrightarrow> s \<in> {s. grant_'_update (\<lambda>_. v) (slot_'_update (\<lambda>_. cte_Ptr rv) (receiver_'_update (\<lambda>_. tcb_Ptr va) (sender_'_update (\<lambda>_. ksCurThread_' (globals s)) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool xb\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<^bsup>s\<^esup>callerCap \<longrightarrow> (cap_get_tag \<^bsup>s\<^esup>callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) = 0 \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) \<longrightarrow> Return \<noteq> Break))))) \<and> (cap_get_tag \<^bsup>s\<^esup>callerCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (cap_get_tag \<^bsup>s\<^esup>callerCap = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> Return \<noteq> Break) \<and> cap_get_tag \<^bsup>s\<^esup>callerCap = SCAST(32 signed \<rightarrow> 32) cap_null_cap)\<rbrace>)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''1157 thread rv (capability.UntypedCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''1152 thread rv (capability.CNodeCap x xa xb xc) (callerCap_' s) x xa xb xc) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> ?R''1147 thread rv capability.IRQControlCap (callerCap_' s))}
 6. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 7. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (5 subgoals):
 1. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> True) \<and> (\<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> (invs' and st_tcb_at' (Not \<circ> isReply) thread and tcb_at' x and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' rv or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv and (\<lambda>a. True)) s)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (rva = capability.IRQControlCap \<longrightarrow> True)\<rbrace>
 2. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (callerCap_' s) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (callerCap_' s) = 0 \<and> cap_get_tag (callerCap_' s) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (callerCap_' s)) \<longrightarrow> (cap_get_tag (callerCap_' s) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (callerCap_' s)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (callerCap_' s))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (callerCap_' s) \<noteq> 8 \<longrightarrow> cap_get_tag (callerCap_' s) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> (xa \<longrightarrow> s \<in> UNIV) \<and> (\<not> xa \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. caller_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. caller_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. x \<noteq> thread \<longrightarrow> s \<in> {s. grant_'_update (\<lambda>_. v) (slot_'_update (\<lambda>_. cte_Ptr rv) (receiver_'_update (\<lambda>_. tcb_Ptr va) (sender_'_update (\<lambda>_. ksCurThread_' (globals s)) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool xb\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. callerCap_' s) sa)) = v}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<^bsup>s\<^esup>callerCap \<longrightarrow> (cap_get_tag \<^bsup>s\<^esup>callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) = 0 \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capReplyCanGrant_CL (cap_reply_cap_lift \<^bsup>s\<^esup>callerCap) \<longrightarrow> Return \<noteq> Break))))) \<and> (cap_get_tag \<^bsup>s\<^esup>callerCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (cap_get_tag \<^bsup>s\<^esup>callerCap = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> Return \<noteq> Break) \<and> cap_get_tag \<^bsup>s\<^esup>callerCap = SCAST(32 signed \<rightarrow> 32) cap_null_cap)\<rbrace>)) \<and> (\<forall>x xa xb xc. rva = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> UNIV) \<and> (\<forall>x xa xb xc. rva = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> UNIV) \<and> (rva = capability.IRQControlCap \<longrightarrow> s \<in> UNIV)}
 3. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 4. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (5 subgoals):
 1. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>rva s. \<forall>x xa. (\<exists>xb. rva = capability.ReplyCap x xa xb) \<longrightarrow> \<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) thread s \<and> tcb_at' x s \<and> sch_act_simple s \<and> ksCurDomain s \<le> maxDomain \<and> (real_cte_at' rv s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv s\<rbrace>
 2. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<lbrace>\<forall>rv. ccap_relation rv \<acute>callerCap \<longrightarrow> (rv = capability.NullCap \<longrightarrow> cap_get_tag \<acute>callerCap = 0 \<and> cap_get_tag \<acute>callerCap \<noteq> 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<acute>callerCap) \<longrightarrow> (cap_get_tag \<acute>callerCap = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap)) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift \<acute>callerCap)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag \<acute>callerCap \<noteq> 8 \<longrightarrow> cap_get_tag \<acute>callerCap = 0))) \<and> (\<forall>x xa xb. rv = capability.ReplyCap x xa xb \<longrightarrow> \<not> xa \<longrightarrow> (x \<noteq> thread \<longrightarrow> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift \<acute>callerCap)) = tcb_ptr_to_ctcb_ptr x \<and> capReplyCanGrant_CL (cap_reply_cap_lift \<acute>callerCap) = from_bool xb) \<and> cap_get_tag \<acute>callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<acute>callerCap) \<longrightarrow> (cap_get_tag \<acute>callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap)) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap) = 0) \<and> (cap_get_tag \<acute>callerCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> cap_get_tag \<acute>callerCap = SCAST(32 signed \<rightarrow> 32) cap_null_cap)))\<rbrace>
 3. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 4. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (5 subgoals):
 1. \<And>thread rv. \<lbrace>?R847 thread rv\<rbrace> do cte <- getCTE rv;
return (cteCap cte)
od \<lbrace>\<lambda>rva s. \<forall>x xa. (\<exists>xb. rva = capability.ReplyCap x xa xb) \<longrightarrow> \<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) thread s \<and> tcb_at' x s \<and> sch_act_simple s \<and> ksCurDomain s \<le> maxDomain \<and> (real_cte_at' rv s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv s\<rbrace>
 2. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<lbrace>\<forall>rv. ccap_relation rv \<acute>callerCap \<longrightarrow> (rv = capability.NullCap \<longrightarrow> cap_get_tag \<acute>callerCap = 0 \<and> cap_get_tag \<acute>callerCap \<noteq> 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<acute>callerCap) \<longrightarrow> (cap_get_tag \<acute>callerCap = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap)) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift \<acute>callerCap)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag \<acute>callerCap \<noteq> 8 \<longrightarrow> cap_get_tag \<acute>callerCap = 0))) \<and> (\<forall>x xa xb. rv = capability.ReplyCap x xa xb \<longrightarrow> \<not> xa \<longrightarrow> (x \<noteq> thread \<longrightarrow> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift \<acute>callerCap)) = tcb_ptr_to_ctcb_ptr x \<and> capReplyCanGrant_CL (cap_reply_cap_lift \<acute>callerCap) = from_bool xb) \<and> cap_get_tag \<acute>callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<acute>callerCap) \<longrightarrow> (cap_get_tag \<acute>callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap)) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap) = 0) \<and> (cap_get_tag \<acute>callerCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> cap_get_tag \<acute>callerCap = SCAST(32 signed \<rightarrow> 32) cap_null_cap)))\<rbrace>
 3. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> ?R847 thread rv s\<rbrace>
 4. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (4 subgoals):
 1. \<And>thread rv. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'850 thread rv (cte_Ptr rv)) \<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<lbrace>\<forall>rv. ccap_relation rv \<acute>callerCap \<longrightarrow> (rv = capability.NullCap \<longrightarrow> cap_get_tag \<acute>callerCap = 0 \<and> cap_get_tag \<acute>callerCap \<noteq> 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<acute>callerCap) \<longrightarrow> (cap_get_tag \<acute>callerCap = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap)) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift \<acute>callerCap)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag \<acute>callerCap \<noteq> 8 \<longrightarrow> cap_get_tag \<acute>callerCap = 0))) \<and> (\<forall>x xa xb. rv = capability.ReplyCap x xa xb \<longrightarrow> \<not> xa \<longrightarrow> (x \<noteq> thread \<longrightarrow> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift \<acute>callerCap)) = tcb_ptr_to_ctcb_ptr x \<and> capReplyCanGrant_CL (cap_reply_cap_lift \<acute>callerCap) = from_bool xb) \<and> cap_get_tag \<acute>callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<acute>callerCap) \<longrightarrow> (cap_get_tag \<acute>callerCap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap)) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift \<acute>callerCap) = 0) \<and> (cap_get_tag \<acute>callerCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> cap_get_tag \<acute>callerCap = SCAST(32 signed \<rightarrow> 32) cap_null_cap)))\<rbrace>
 2. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) rv s \<longrightarrow> (\<forall>x xa. (\<exists>xb. cteCap cte = capability.ReplyCap x xa xb) \<longrightarrow> \<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) thread s \<and> tcb_at' x s \<and> sch_act_simple s \<and> ksCurDomain s \<le> maxDomain \<and> (real_cte_at' rv s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv s))\<rbrace>
 3. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?R'850 thread rv (cte_Ptr rv)}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (3 subgoals):
 1. \<And>thread. \<lbrace>?R521 thread\<rbrace> return (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) rv s \<longrightarrow> (\<forall>x xa. (\<exists>xb. cteCap cte = capability.ReplyCap x xa xb) \<longrightarrow> \<not> xa \<longrightarrow> x \<noteq> thread \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) thread s \<and> tcb_at' x s \<and> sch_act_simple s \<and> ksCurDomain s \<le> maxDomain \<and> (real_cte_at' rv s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) rv s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) rv s))\<rbrace>
 2. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>rva. ccap_relation rva (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) \<noteq> 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) \<noteq> 8 \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> \<not> xa \<longrightarrow> (x \<noteq> thread \<longrightarrow> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x \<and> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) = from_bool xb) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) = 0) \<and> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap)))\<rbrace>}
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> ?R521 (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (2 subgoals):
 1. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/?F521 thread\<^esub> (?R'521 thread) Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. callerSlot_' s = cte_Ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>rva. ccap_relation rva (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) \<noteq> 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) \<noteq> 8 \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> \<not> xa \<longrightarrow> (x \<noteq> thread \<longrightarrow> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x \<and> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) = from_bool xb) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))) = 0) \<and> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap)))\<rbrace>}
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> (cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> (\<forall>x xa. (\<exists>xb. cteCap cte = capability.ReplyCap x xa xb) \<longrightarrow> \<not> xa \<longrightarrow> x \<noteq> ksCurThread s \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> tcb_at' x s \<and> sch_act_simple s \<and> ksCurDomain s \<le> maxDomain \<and> (real_cte_at' (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s))) \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> ?R'521 rv) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> (cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> (\<forall>x xa. (\<exists>xb. cteCap cte = capability.ReplyCap x xa xb) \<longrightarrow> \<not> xa \<longrightarrow> x \<noteq> ksCurThread s \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s \<and> tcb_at' x s \<and> sch_act_simple s \<and> ksCurDomain s \<le> maxDomain \<and> (real_cte_at' (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s))) \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<in> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd \<acute>t_hrs) \<longrightarrow> (\<forall>rva. cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr rva \<longrightarrow> (\<forall>rvb. ccap_relation rvb (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) \<longrightarrow> (rvb = capability.NullCap \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) \<noteq> 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C''])))) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) \<noteq> 8 \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) = 0))) \<and> (\<forall>x xa xb. rvb = capability.ReplyCap x xa xb \<longrightarrow> \<not> xa \<longrightarrow> (x \<noteq> rv \<longrightarrow> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv \<and> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x \<and> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C''])))) = from_bool xb) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> ((\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C''])))) = 0) \<and> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rva\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap)))))\<rbrace>) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits \<and> (cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> (\<forall>x xa. (\<exists>xb. cteCap cte = capability.ReplyCap x xa xb) \<longrightarrow> \<not> xa \<longrightarrow> x \<noteq> ksCurThread s \<longrightarrow> tcb_at' x s \<and> ksCurDomain s \<le> maxDomain \<and> (real_cte_at' (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s))) \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> (\<forall>rva. ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (rva = capability.NullCap \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> (capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8 \<and> ((\<exists>t. ret__unsigned_' t = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = 8)))) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> 8 \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = 0))) \<and> (\<forall>x xa xb. rva = capability.ReplyCap x xa xb \<longrightarrow> \<not> xa \<longrightarrow> (x \<noteq> rv \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x \<and> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = from_bool xb) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap))))) proof (prove)
goal (8 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s\<rbrakk> \<Longrightarrow> is_aligned (ksCurThread s) tcbBlockSizeBits
 2. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> tcb_at' x s
 3. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 4. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s; real_cte_at' (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s
 5. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s
 6. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x
 7. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = from_bool xb
 8. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; \<exists>t. ret__unsigned_' t = 8; \<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))\<rbrakk> \<Longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 proof (prove)
goal (7 subgoals):
 1. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> tcb_at' x s
 2. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 3. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s; real_cte_at' (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s
 4. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s
 5. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x
 6. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = from_bool xb
 7. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; \<exists>t. ret__unsigned_' t = 8; \<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))\<rbrakk> \<Longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 proof (prove)
goal (6 subgoals):
 1. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 2. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s; real_cte_at' (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s
 3. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s
 4. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x
 5. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = from_bool xb
 6. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; \<exists>t. ret__unsigned_' t = 8; \<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))\<rbrakk> \<Longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 proof (prove)
goal (5 subgoals):
 1. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s; real_cte_at' (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s
 2. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s
 3. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x
 4. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = from_bool xb
 5. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; \<exists>t. ret__unsigned_' t = 8; \<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))\<rbrakk> \<Longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 proof (prove)
goal (4 subgoals):
 1. \<And>s s' cte x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<exists>xa. cteCap cte = capability.ReplyCap x False xa; \<not> xa; x \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s
 2. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x
 3. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = from_bool xb
 4. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; \<exists>t. ret__unsigned_' t = 8; \<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))\<rbrakk> \<Longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 proof (prove)
goal (3 subgoals):
 1. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr x
 2. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; x \<noteq> rv\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = from_bool xb
 3. \<And>s s' rv rva x xa xb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread s) s; sch_act_simple s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00)) (sint Kernel_C.tcbCaller) False (hrs_htd (t_hrs_' (globals s'))); ccap_relation (capability.ReplyCap x False xb) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); rva = capability.ReplyCap x False xb; \<not> xa; \<exists>t. ret__unsigned_' t = 8; \<exists>t. ret__unsigned_' t = capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))))\<rbrakk> \<Longrightarrow> capReplyMaster_CL (cap_reply_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr rv) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCaller * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 proof (prove)
goal:
No subgoals!