theory Tcb_C

lemma setupReplyMaster_ccorres:
  "ccorres dc xfdc (tcb_at' t)
        (UNIV \<inter> {s. thread_' s = tcb_ptr_to_ctcb_ptr t}) []
        (setupReplyMaster t) (Call setupReplyMaster_'proc)" apply (cinit lift: thread_') apply (rule ccorres_move_array_assertion_tcb_ctes ccorres_Guard_Seq)+ apply ctac apply (simp del: Collect_const) apply (rule ccorres_pre_getCTE) apply (rule ccorres_move_c_guard_cte) apply (rule_tac F="\<lambda>rv'. (rv' = scast cap_null_cap) = (cteCap oldCTE = NullCap)"
                 and R="cte_wp_at' ((=) oldCTE) rv"
               and xf'=ret__unsigned_'
                  in ccorres_symb_exec_r_abstract_UNIV[where R'=UNIV]) apply (rule conseqPre, vcg) apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule(1) cmap_relationE1[OF cmap_relation_cte]) apply (clarsimp simp: typ_heap_simps cap_get_tag_isCap
                       dest!: ccte_relation_ccap_relation) apply ceqv apply (simp only:) apply (rule ccorres_when[where R=\<top>]) apply (simp add: Collect_const_mem) apply (rule ccorres_symb_exec_l [OF _ _ _ empty_fail_stateAssert]) apply (rule_tac P="cte_at' rv and tcb_at' t" in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule cmap_relationE1[OF cmap_relation_cte], assumption+) apply (rule conjI, fastforce intro: typ_heap_simps) apply (clarsimp simp: typ_heap_simps) apply (rule fst_setCTE[OF ctes_of_cte_at], assumption) apply (rule rev_bexI, assumption) apply (clarsimp simp: rf_sr_def cstate_relation_def
                              cpspace_relation_def Let_def
                              typ_heap_simps') apply (subst setCTE_tcb_case, assumption+) apply (rule_tac r="s'" in KernelStateData_H.kernel_state.cases) apply clarsimp apply (rule conjI) apply (erule(2) cmap_relation_updI) apply (clarsimp simp: ccte_relation_def cap_reply_cap_lift cte_lift_def
                                cong: option.case_cong_weak) apply (simp add: cte_to_H_def cap_to_H_def mdb_node_to_H_def
                           nullMDBNode_def c_valid_cte_def) apply (simp add: cap_reply_cap_lift) apply (subst is_aligned_neg_mask_weaken) apply (erule is_aligned_tcb_ptr_to_ctcb_ptr) apply (simp add: ctcb_size_bits_def) apply simp apply simp apply (simp add: cmachine_state_relation_def
                         typ_heap_simps'
                         carch_state_relation_def carch_globals_def
                         cvariable_array_map_const_add_map_option[where f="tcb_no_ctes_proj"]) apply (wp | simp)+ apply (clarsimp simp: guard_is_UNIV_def) apply (wp | simp add: locateSlot_conv)+ apply vcg apply (clarsimp simp: word_sle_def cte_wp_at_ctes_of
                        tcb_cnode_index_defs tcbReplySlot_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (tcb_at' t) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr t\<rbrace>) [] (setupReplyMaster t) (Call setupReplyMaster_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ccorres dc xfdc (?Q593 thread) (?Q'593 thread) [SKIP] (do slot <- locateSlotTCB t tcbReplySlot;
oldCTE <- getCTE slot;
when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE slot (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val thread));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI))
 2. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q593 thread s \<and> s' \<in> ?Q'593 thread proof (prove)
goal (2 subgoals):
 1. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ccorres dc xfdc (?A599 thread) (?C'599 thread) [SKIP] (do slot <- locateSlotTCB t tcbReplySlot;
oldCTE <- getCTE slot;
when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE slot (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)
od) (\<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val thread));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI))
 2. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A599 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> ?C'599 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>thread rv slot. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q603 thread rv) (?Q'603 thread rv slot) [SKIP] (do oldCTE <- getCTE rv;
when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val thread));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(slot\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(slot\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI)
 2. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>?Q603 thread\<rbrace>
 3. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'603 thread rv (slot_' s)}
 4. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>thread rv slot. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q603 (tcb_ptr_to_ctcb_ptr t) rv) (?Q'603 (tcb_ptr_to_ctcb_ptr t) rv (cte_Ptr rv)) [SKIP] (do oldCTE <- getCTE rv;
when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI)
 2. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>?Q603 thread\<rbrace>
 3. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> ?Q'603 thread rv (slot_' s)}
 4. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P840 (tcb_ptr_to_ctcb_ptr t) rv a oldCTE) (?P'842 rv oldCTE) [SKIP] (when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI)
 2. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ?P840 thread a b cte\<rbrace>
 3. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?P'841 thread rv (slot_' s) cte'}}
 4. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>
flex-flex pairs:
\<lambda>rv cte'. ?P'842 rv (cte_to_H cte') \<equiv>\<^sup>? \<lambda>rv. ?P'841 (tcb_ptr_to_ctcb_ptr t) rv (cte_Ptr rv) proof (prove)
goal (4 subgoals):
 1. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A850 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?C'849 rv oldCTE) [SKIP] (when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI)
 2. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?A850 thread a cte and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 3. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?C'848 thread rv (slot_' s) cte' \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>
flex-flex pairs:
\<lambda>rv cte'. ?C'849 rv (cte_to_H cte') \<equiv>\<^sup>? \<lambda>rv. ?C'848 (tcb_ptr_to_ctcb_ptr t) rv (cte_Ptr rv) proof (prove)
goal (7 subgoals):
 1. \<And>thread rv slot oldCTE s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. cte_wp_at' ((=) oldCTE) rv s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>(\<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrace>)
 2. \<And>thread rv slot oldCTE rv' ta t'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?y'853 thread rv slot oldCTE rv')
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P856 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?Q853 thread rv slot oldCTE rv') [SKIP] (when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)) (?y'853 thread rv slot oldCTE rv')
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva. ?Q853 thread rv slot oldCTE)
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P856 thread a cte and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>thread rv slot oldCTE s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. cte_wp_at' ((=) oldCTE) rv s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))\<rparr>) \<in> rf_sr \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)}
 2. \<And>thread rv slot oldCTE rv' ta t'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?y'853 thread rv slot oldCTE rv')
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P856 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?Q853 thread rv slot oldCTE rv') [SKIP] (when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)) (?y'853 thread rv slot oldCTE rv')
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva. ?Q853 thread rv slot oldCTE)
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P856 thread a cte and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE s x t. \<lbrakk>ctes_of s rv = Some oldCTE; (s, x) \<in> rf_sr; ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)
 2. \<And>thread rv slot oldCTE rv' ta t'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?y'853 thread rv slot oldCTE rv')
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P856 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?Q853 thread rv slot oldCTE rv') [SKIP] (when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)) (?y'853 thread rv slot oldCTE rv')
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva. ?Q853 thread rv slot oldCTE)
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P856 thread a cte and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE s x t y'. \<lbrakk>ctes_of s rv = Some oldCTE; ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))); ctes_of s rv = Some oldCTE; ccte_relation oldCTE y'; cslift x (cte_Ptr rv) = Some y'\<rbrakk> \<Longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)
 2. \<And>thread rv slot oldCTE rv' ta t'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?y'853 thread rv slot oldCTE rv')
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P856 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?Q853 thread rv slot oldCTE rv') [SKIP] (when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)) (?y'853 thread rv slot oldCTE rv')
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva. ?Q853 thread rv slot oldCTE)
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P856 thread a cte and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>thread rv slot oldCTE rv' ta t'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?y'853 thread rv slot oldCTE rv')
 2. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P856 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?Q853 thread rv slot oldCTE rv') [SKIP] (when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)) (?y'853 thread rv slot oldCTE rv')
 3. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva. ?Q853 thread rv slot oldCTE)
 4. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P856 thread a cte and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P856 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?Q853 thread rv slot oldCTE rv') [SKIP] (when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)) (IF rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI)
 2. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva. ?Q853 thread rv slot oldCTE)
 3. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P856 thread a cte and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 4. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P856 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?Q853 (tcb_ptr_to_ctcb_ptr t) rv (cte_Ptr rv) oldCTE rv') [SKIP] (when (cteCap oldCTE = capability.NullCap) (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od)) (IF cteCap oldCTE = capability.NullCap THEN
  \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI)
 2. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva. ?Q853 thread rv slot oldCTE)
 3. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P856 thread a cte and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 4. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (cteCap oldCTE = capability.NullCap) = (s' \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace>)
 2. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?Rt1069 (tcb_ptr_to_ctcb_ptr t) rv (cte_Ptr rv) oldCTE rv') [SKIP] (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od) (\<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true)))
 3. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> ?Rt1069 thread rv slot oldCTE a) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 4. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE) (?Rt1069 (tcb_ptr_to_ctcb_ptr t) rv (cte_Ptr rv) oldCTE rv') [SKIP] (do y <- stateAssert (noReplyCapsFor t) [];
setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))
od) (\<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true)))
 2. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> ?Rt1069 thread rv slot oldCTE a) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 3. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 4. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>thread rv slot oldCTE rv' rva. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1085 (tcb_ptr_to_ctcb_ptr t) rv (cte_Ptr rv) oldCTE rv' rva) (?Q'1083 (tcb_ptr_to_ctcb_ptr t) rv (cte_Ptr rv) oldCTE rv' rva) [SKIP] (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))) (\<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true)))
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>?Q1085 (tcb_ptr_to_ctcb_ptr t) rv (cte_Ptr rv) oldCTE rv'\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q1085 thread rv slot oldCTE a rva s \<longrightarrow> s' \<in> ?Q'1083 thread rv slot oldCTE a rva}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>thread rv slot oldCTE rv' rva. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_reply_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ptr_val (tcb_ptr_to_ctcb_ptr t));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbRevocable_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) true)) {s. \<exists>(rv, \<sigma>')\<in>fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>thread rv slot oldCTE rv' rva \<sigma>. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> {s. (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>ta. cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> s \<Turnstile>\<^sub>c cte_Ptr rv \<and> (\<forall>tb. mdb_node_lift (ret__struct_mdb_node_C_' tb) = \<lparr>mdbNext_CL = 0 && ~~ mask 3, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1, mdbPrev_CL = 0 && ~~ mask 3\<rparr> \<longrightarrow> hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t cte_Ptr rv \<and> hrs_htd (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals s)))) \<Turnstile>\<^sub>t cte_Ptr rv \<and> hrs_htd (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals s)))) \<Turnstile>\<^sub>t cparent (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C''] \<and> (\<forall>tc. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (clift (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals s)))) (cparent (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C'']))))\<lparr>mdbRevocable_CL := SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> t_hrs_' (globals tc) = hrs_mem_update (heap_update (cparent (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (clift (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals s)))) (cparent (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C'']))))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals s))))) \<longrightarrow> tc \<Turnstile>\<^sub>c cte_Ptr rv \<and> tc \<Turnstile>\<^sub>c cparent (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C''] \<and> (\<forall>td. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift tc (cparent (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C'']))))\<lparr>mdbFirstBadged_CL := SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> t_hrs_' (globals td) = hrs_mem_update (heap_update (cparent (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift tc (cparent (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C'']))))) (t_hrs_' (globals tc))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' tb, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals td)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' tb, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals td)\<rparr>\<rparr>))))))}
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); ctes_of \<sigma> rv = Some cte; tcb_at' t \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr rv \<and> (\<forall>tb. mdb_node_lift (ret__struct_mdb_node_C_' tb) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr> \<longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr rv \<and> (\<forall>tc. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (clift (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))) (cte_Ptr rv))))\<lparr>mdbRevocable_CL := SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (clift (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))) (cte_Ptr rv))))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x))))) \<longrightarrow> tc \<Turnstile>\<^sub>c cte_Ptr rv \<and> (\<forall>td. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift tc (cte_Ptr rv))))\<lparr>mdbFirstBadged_CL := SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> t_hrs_' (globals td) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift tc (cte_Ptr rv))))) (t_hrs_' (globals tc))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' tb, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals td)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y'. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); ctes_of \<sigma> rv = Some cte; tcb_at' t \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr rv \<and> (\<forall>tb. mdb_node_lift (ret__struct_mdb_node_C_' tb) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr> \<longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr rv \<and> (\<forall>tc. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (clift (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))) (cte_Ptr rv))))\<lparr>mdbRevocable_CL := SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (clift (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))) (cte_Ptr rv))))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x))))) \<longrightarrow> tc \<Turnstile>\<^sub>c cte_Ptr rv \<and> (\<forall>td. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift tc (cte_Ptr rv))))\<lparr>mdbFirstBadged_CL := SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> t_hrs_' (globals td) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift tc (cte_Ptr rv))))) (t_hrs_' (globals tc))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' tb, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals td)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y'. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); ctes_of \<sigma> rv = Some cte; tcb_at' t \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'\<rbrakk> \<Longrightarrow> \<forall>tb. mdb_node_lift (ret__struct_mdb_node_C_' tb) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr> \<longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr rv \<and> (\<forall>tc. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (clift (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))) (cte_Ptr rv))))\<lparr>mdbRevocable_CL := SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (clift (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))) (cte_Ptr rv))))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' tb)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x))))) \<longrightarrow> tc \<Turnstile>\<^sub>c cte_Ptr rv \<and> (\<forall>td. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift tc (cte_Ptr rv))))\<lparr>mdbFirstBadged_CL := SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> t_hrs_' (globals td) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift tc (cte_Ptr rv))))) (t_hrs_' (globals tc))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' tb, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals td)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' taa)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' taa)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>). case xa of (rva, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' taa, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' taa)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea s'. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' taa)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' taa)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x))))); ((), s') \<in> fst (setCTE rv (?cte1220 rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(rv \<mapsto> ?cte1220 rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>). case xa of (rva, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' taa, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' taa)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea s'. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' taa)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' taa)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x))))); ((), s') \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> case ((), s') of (rva, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' taa, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr rv\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' taa)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr rv\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' ta)) (t_hrs_' (globals x)))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea s'. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), s') \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))) ((cslift x)(cte_Ptr rv \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea s'. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), s') \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))) ((cslift x)(cte_Ptr rv \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) cte_Ptr ccte_relation \<and> True \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea s' ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), s') \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; s' = \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))) ((cslift x)(cte_Ptr rv \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) cte_Ptr ccte_relation \<and> True \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))) ((cslift x)(cte_Ptr rv \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) cte_Ptr ccte_relation \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)))) ((cslift x)(cte_Ptr rv \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) cte_Ptr ccte_relation
 2. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 5. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 7. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> ccte_relation (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))
 2. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 6. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 8. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_lift (ret__struct_cap_C_' ta) = Some (Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>); ctes_of \<sigma> rv = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; Some cte = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); c_valid_cte y'\<rbrakk> \<Longrightarrow> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode)) = cte_to_H \<lparr>cap_CL = Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>, cteMDBNode_CL = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>\<rparr> \<and> c_valid_cte (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))
 2. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 6. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 8. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_lift (ret__struct_cap_C_' ta) = Some (Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>); ctes_of \<sigma> rv = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; Some cte = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); c_valid_cap (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> t = ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6)) \<and> c_valid_cap (ret__struct_cap_C_' ta)
 2. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 6. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 8. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_lift (ret__struct_cap_C_' ta) = Some (Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>); ctes_of \<sigma> rv = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; Some cte = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); c_valid_cap (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> t = ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6))
 2. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 6. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 8. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_lift (ret__struct_cap_C_' ta) = Some (Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>); ctes_of \<sigma> rv = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; Some cte = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); c_valid_cap (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr t)) (?n1284 rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea)
 2. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_lift (ret__struct_cap_C_' ta) = Some (Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>); ctes_of \<sigma> rv = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; Some cte = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); c_valid_cap (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> 6 \<le> ?n1284 rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea
 3. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_lift (ret__struct_cap_C_' ta) = Some (Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>); ctes_of \<sigma> rv = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; Some cte = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); c_valid_cap (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> t = ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t)))
 4. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 5. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 6. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 8. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 10. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_lift (ret__struct_cap_C_' ta) = Some (Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>); ctes_of \<sigma> rv = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; Some cte = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); c_valid_cap (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> 6 \<le> ctcb_size_bits
 2. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_lift (ret__struct_cap_C_' ta) = Some (Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>); ctes_of \<sigma> rv = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; Some cte = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); c_valid_cap (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> t = ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t)))
 3. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 4. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 5. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 7. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 9. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_lift (ret__struct_cap_C_' ta) = Some (Cap_reply_cap \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>); ctes_of \<sigma> rv = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (MDB nullPointer nullPointer True True)); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; Some cte = map_option cte_to_H (case cap_lift (cte_C.cap_C y') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C y')\<rparr>); c_valid_cap (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> t = ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t)))
 2. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 6. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 8. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 2. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 5. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 7. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv oldCTE rv' \<sigma> x ta cte y' taa tb mdb_node tc mdb_nodea ksPSpacea gsUserPagesa gsCNodesa gsUntypedZeroRangesa gsMaxObjectSizea ksDomScheduleIdxa ksDomSchedulea ksCurDomaina ksDomainTimea ksReadyQueuesa ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa ksCurThreada ksIdleThreada ksSchedulerActiona ksInterruptStatea ksWorkUnitsCompleteda ksArchStatea ksMachineStatea. \<lbrakk>(rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap); tcb_at' t \<sigma>; cap_reply_cap_lift (ret__struct_cap_C_' ta) = \<lparr>capReplyCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true, capReplyMaster_CL = SCAST(32 signed \<rightarrow> 32) true, capTCBPtr_CL = ptr_val (tcb_ptr_to_ctcb_ptr t) && ~~ mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; ctes_of \<sigma> rv = Some cte; ccte_relation cte y'; cslift x (cte_Ptr rv) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' taa) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; mdb_node_lift mdb_node = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))); mdb_node_lift mdb_nodea = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) true, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) true, mdbPrev_CL = 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x))))); ((), \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>) \<in> fst (setCTE rv (CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))) \<sigma>); \<lparr>ksPSpace = ksPSpacea, gsUserPages = gsUserPagesa, gsCNodes = gsCNodesa, gsUntypedZeroRanges = gsUntypedZeroRangesa, gsMaxObjectSize = gsMaxObjectSizea, ksDomScheduleIdx = ksDomScheduleIdxa, ksDomSchedule = ksDomSchedulea, ksCurDomain = ksCurDomaina, ksDomainTime = ksDomainTimea, ksReadyQueues = ksReadyQueuesa, ksReadyQueuesL1Bitmap = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap = ksReadyQueuesL2Bitmapa, ksCurThread = ksCurThreada, ksIdleThread = ksIdleThreada, ksSchedulerAction = ksSchedulerActiona, ksInterruptState = ksInterruptStatea, ksWorkUnitsCompleted = ksWorkUnitsCompleteda, ksArchState = ksArchStatea, ksMachineState = ksMachineStatea\<rparr> = \<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>; map_to_ctes ksPSpacea = (ctes_of \<sigma>)(rv \<mapsto> CTE (capability.ReplyCap t True True) (mdbFirstBadged_update (\<lambda>_. True) (mdbRevocable_update (\<lambda>_. True) nullMDBNode))); map_to_eps (ksPSpace \<sigma>) = map_to_eps ksPSpacea; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ksPSpacea; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ksPSpacea; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ksPSpacea; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ksPSpacea; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ksPSpacea; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ksPSpacea; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ksPSpacea; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ksPSpacea\<rparr>); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ksPSpacea) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ksPSpacea) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ksPSpacea) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ksPSpacea) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ksPSpacea) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ksPSpacea (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ksPSpacea) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ksPSpacea) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. mdb_node) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' taa) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y'))) (hrs_mem_update (heap_update (cte_Ptr rv) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' ta) y')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ksPSpacea) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 4. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>thread rv slot oldCTE rv' s. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>thread rv slot oldCTE rv'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv; (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<lbrace>?Pt1071 (tcb_ptr_to_ctcb_ptr t) rv oldCTE\<rbrace> stateAssert (noReplyCapsFor t) [] \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) rv and tcb_at' t\<rbrace>
 3. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rva a. {s. (s \<in> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>_. True) rv and tcb_at' t) s \<longrightarrow> s' \<in> UNIV}) \<and> (s \<notin> \<lbrace>cteCap oldCTE = capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)})
 4. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pt1071 thread a cte s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 5. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>thread rv slot oldCTE. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; slot = cte_Ptr rv\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap oldCTE = capability.NullCap)) ret__unsigned_' (\<lambda>rv a. UNIV)
 2. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> noReplyCapsFor t s \<longrightarrow> (cte_wp_at' (\<lambda>_. True) a and tcb_at' t) s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 3. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R603 thread\<rbrace> locateSlotTCB t tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> noReplyCapsFor t s \<longrightarrow> (cte_wp_at' (\<lambda>_. True) a and tcb_at' t) s) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> True) and cte_wp_at' ((=) cte) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 2. \<And>thread. thread = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 thread) \<acute>slot :== cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 3. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R603 thread and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'603 (tcb_ptr_to_ctcb_ptr t)) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) UNIV
 2. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. \<forall>cte. ctes_of a (t + 2 ^ cte_level_bits * tcbReplySlot) = Some cte \<longrightarrow> (cteCap cte = capability.NullCap \<longrightarrow> noReplyCapsFor t a \<longrightarrow> cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbReplySlot) a \<and> tcb_at' t a) \<and> cte_wp_at' ((=) cte) (t + 2 ^ cte_level_bits * tcbReplySlot) a \<and> cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbReplySlot) a) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'603 thread \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>thread s s'. \<lbrakk>thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. \<forall>cte. ctes_of a (t + 2 ^ cte_level_bits * tcbReplySlot) = Some cte \<longrightarrow> (cteCap cte = capability.NullCap \<longrightarrow> noReplyCapsFor t a \<longrightarrow> cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbReplySlot) a \<and> tcb_at' t a) \<and> cte_wp_at' ((=) cte) (t + 2 ^ cte_level_bits * tcbReplySlot) a \<and> cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbReplySlot) a) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) s \<and> s' \<in> \<lbrace>t = ptr_val thread && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace> proof (prove)
goal:
No subgoals!