theory Ipc_R

lemma doReplyTransfer_corres:
  "corres dc
     (einvs and tcb_at receiver and tcb_at sender
           and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)
     (invs' and tcb_at' sender and tcb_at' receiver
            and valid_pspace' and cte_at' (cte_map slot))
     (do_reply_transfer sender receiver slot grant)
     (doReplyTransfer sender receiver (cte_map slot) grant)" apply (simp add: do_reply_transfer_def doReplyTransfer_def cong: option.case_cong) apply (rule corres_underlying_split [OF _ _ gts_sp gts_sp']) apply (rule corres_guard_imp) apply (rule getThreadState_corres, (clarsimp simp add: st_tcb_at_tcb_at)+) apply (rule_tac F = "awaiting_reply state" in corres_req) apply (clarsimp simp add: st_tcb_at_def obj_at_def is_tcb) apply (fastforce simp: invs_def valid_state_def intro: has_reply_cap_cte_wpD
                   dest: has_reply_cap_cte_wpD
                  dest!: valid_reply_caps_awaiting_reply cte_wp_at_is_reply_cap_toI) apply (case_tac state, simp_all add: bind_assoc) apply (simp add: isReply_def liftM_def) apply (rule corres_symb_exec_r[OF _ getCTE_sp getCTE_inv, rotated]) apply (rule no_fail_pre, wp) apply clarsimp apply (rename_tac mdbnode) apply (rule_tac P="Q" and Q="Q" and P'="Q'" and Q'="(\<lambda>s. Q' s \<and> R' s)" for Q Q' R'
            in stronger_corres_guard_imp[rotated]) apply assumption apply (rule conjI, assumption) apply (clarsimp simp: cte_wp_at_ctes_of) apply (drule cte_wp_at_is_reply_cap_toI) apply (erule(4) reply_cap_end_mdb_chain) apply (rule corres_assert_assume[rotated], simp) apply (simp add: getSlotCap_def) apply (rule corres_symb_exec_r[OF _ getCTE_sp getCTE_inv, rotated]) apply (rule no_fail_pre, wp) apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule corres_assert_assume[rotated]) apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule corres_guard_imp) apply (rule corres_split[OF threadget_fault_corres]) apply (case_tac rv, simp_all add: fault_rel_optionation_def bind_assoc)[1] apply (rule corres_split[OF doIPCTransfer_corres]) apply (rule corres_split[OF cap_delete_one_corres]) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (rule possibleSwitchTo_corres) apply (wp set_thread_state_runnable_valid_sched set_thread_state_runnable_weak_valid_sched_action sts_st_tcb_at' sts_st_tcb' sts_valid_queues sts_valid_objs' delete_one_tcbDomain_obj_at'
                   | simp add: valid_tcb_state'_def)+ apply (strengthen cte_wp_at_reply_cap_can_fast_finalise) apply (wp hoare_vcg_conj_lift) apply (rule hoare_strengthen_post [OF do_ipc_transfer_non_null_cte_wp_at]) prefer 2 apply (erule cte_wp_at_weakenE) apply (fastforce) apply (clarsimp simp:is_cap_simps) apply (wp weak_valid_sched_action_lift)+ apply (rule_tac Q="\<lambda>_. valid_queues' and valid_objs' and cur_tcb' and tcb_at' receiver and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)" in hoare_post_imp, simp add: sch_act_wf_weak) apply (wp tcb_in_cur_domain'_lift) defer apply (simp) apply (wp)+ apply (clarsimp) apply (rule conjI, erule invs_valid_objs) apply (rule conjI, clarsimp)+ apply (rule conjI) apply (erule cte_wp_at_weakenE) apply (clarsimp) apply (rule conjI, rule refl) apply (fastforce) apply (clarsimp simp: invs_def valid_sched_def valid_sched_action_def) apply (simp) apply (auto simp: invs'_def valid_state'_def)[1] apply (rule corres_guard_imp) apply (rule corres_split[OF cap_delete_one_corres]) apply (rule corres_split_mapr[OF getMessageInfo_corres]) apply (rule corres_split_eqr[OF lookupIPCBuffer_corres']) apply (rule corres_split_eqr[OF getMRs_corres]) apply (simp(no_asm) del: dc_simp) apply (rule corres_split_eqr[OF handleFaultReply_corres]) apply simp apply (rule corres_split) apply (rule threadset_corresT;
                        clarsimp simp add: tcb_relation_def fault_rel_optionation_def
                                           tcb_cap_cases_def tcb_cte_cases_def exst_same_def) apply (rule_tac P="valid_sched and cur_tcb and tcb_at receiver"
                            and P'="tcb_at' receiver and cur_tcb'
                                      and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)
                                      and Invariants_H.valid_queues and valid_queues' and valid_objs'"
                              in corres_inst) apply (case_tac rvb, simp_all)[1] apply (rule corres_guard_imp) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (fold dc_def, rule possibleSwitchTo_corres) apply simp apply (wp hoare_weak_lift_imp hoare_weak_lift_imp_conj set_thread_state_runnable_weak_valid_sched_action sts_st_tcb_at'
                              sts_st_tcb' sts_valid_queues | simp | force simp: valid_sched_def valid_sched_action_def valid_tcb_state'_def)+ apply (rule corres_guard_imp) apply (rule setThreadState_corres) apply clarsimp+ apply (wp threadSet_cur weak_sch_act_wf_lift_linear threadSet_pred_tcb_no_state
                         thread_set_not_state_valid_sched threadSet_valid_queues threadSet_valid_queues'
                         threadSet_tcbDomain_triv threadSet_valid_objs'
                    | simp add: valid_tcb_state'_def)+ apply (wp threadSet_cur weak_sch_act_wf_lift_linear threadSet_pred_tcb_no_state
                      thread_set_not_state_valid_sched threadSet_valid_queues threadSet_valid_queues'
                 | simp add: runnable_def inQ_def valid_tcb'_def)+ apply (rule_tac Q="\<lambda>_. valid_sched and cur_tcb and tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned"
                     in hoare_strengthen_post [rotated], clarsimp) apply (wp) apply (rule hoare_chain [OF cap_delete_one_invs]) apply (assumption) apply (rule conjI, clarsimp) apply (clarsimp simp add: invs_def valid_state_def) apply (rule_tac Q="\<lambda>_. tcb_at' sender and tcb_at' receiver and invs'"
                    in hoare_strengthen_post [rotated]) apply (solves\<open>auto simp: invs'_def valid_state'_def\<close>) apply wp apply clarsimp apply (rule conjI) apply (erule cte_wp_at_weakenE) apply (clarsimp simp add: can_fast_finalise_def) apply (erule(1) emptyable_cte_wp_atD) apply (rule allI, rule impI) apply (clarsimp simp add: is_master_reply_cap_def) apply (clarsimp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot) (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (do_reply_transfer sender receiver slot grant) (doReplyTransfer sender receiver (cte_map slot) grant) proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot) (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (do state <- get_thread_state receiver;
y <- assert (awaiting_reply state);
thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)
od) (do state <- getThreadState receiver;
y <- assert (isReply state);
mdbNode <- liftM cteMDBNode (getCTE (cte_map slot));
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. corres ?r'6 (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot) (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (get_thread_state receiver) (getThreadState receiver)
 2. \<And>state statea. ?r'6 state statea \<Longrightarrow> corres dc (st_tcb_at ((=) state) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (st_tcb_at' (\<lambda>st. st = statea) receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) (do y <- assert (awaiting_reply state);
thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)
od) (do y <- assert (isReply statea);
mdbNode <- liftM cteMDBNode (getCTE (cte_map slot));
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (4 subgoals):
 1. corres ?r'6 ?Q13 ?Q'13 (get_thread_state receiver) (getThreadState receiver)
 2. \<And>s. (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot) s \<Longrightarrow> ?Q13 s
 3. \<And>s. (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s \<Longrightarrow> ?Q'13 s
 4. \<And>state statea. ?r'6 state statea \<Longrightarrow> corres dc (st_tcb_at ((=) state) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (st_tcb_at' (\<lambda>st. st = statea) receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) (do y <- assert (awaiting_reply state);
thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)
od) (do y <- assert (isReply statea);
mdbNode <- liftM cteMDBNode (getCTE (cte_map slot));
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>state statea. thread_state_relation state statea \<Longrightarrow> corres dc (st_tcb_at ((=) state) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (st_tcb_at' (\<lambda>st. st = statea) receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) (do y <- assert (awaiting_reply state);
thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)
od) (do y <- assert (isReply statea);
mdbNode <- liftM cteMDBNode (getCTE (cte_map slot));
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>state statea s s'. \<lbrakk>thread_state_relation state statea; (s, s') \<in> state_relation; (st_tcb_at ((=) state) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s; (st_tcb_at' (\<lambda>st. st = statea) receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) s'\<rbrakk> \<Longrightarrow> awaiting_reply state
 2. \<And>state statea. \<lbrakk>thread_state_relation state statea; awaiting_reply state\<rbrakk> \<Longrightarrow> corres dc (st_tcb_at ((=) state) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (st_tcb_at' (\<lambda>st. st = statea) receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) (do y <- assert (awaiting_reply state);
thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)
od) (do y <- assert (isReply statea);
mdbNode <- liftM cteMDBNode (getCTE (cte_map slot));
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>statea s s' tcb tcbb. \<lbrakk>thread_state_relation (tcb_state tcb) statea; (s, s') \<in> state_relation; st_tcb_at' (\<lambda>st. st = statea) receiver s'; invs s; invs' s'; valid_list s; tcb_at' sender s'; valid_sched s; tcb_at' receiver s'; valid_pspace' s'; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s; kheap s receiver = Some (TCB tcb); kheap s sender = Some (TCB tcbb)\<rbrakk> \<Longrightarrow> awaiting_reply (tcb_state tcb)
 2. \<And>state statea. \<lbrakk>thread_state_relation state statea; awaiting_reply state\<rbrakk> \<Longrightarrow> corres dc (st_tcb_at ((=) state) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (st_tcb_at' (\<lambda>st. st = statea) receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) (do y <- assert (awaiting_reply state);
thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)
od) (do y <- assert (isReply statea);
mdbNode <- liftM cteMDBNode (getCTE (cte_map slot));
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>state statea. \<lbrakk>thread_state_relation state statea; awaiting_reply state\<rbrakk> \<Longrightarrow> corres dc (st_tcb_at ((=) state) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (st_tcb_at' (\<lambda>st. st = statea) receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) (do y <- assert (awaiting_reply state);
thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)
od) (do y <- assert (isReply statea);
mdbNode <- liftM cteMDBNode (getCTE (cte_map slot));
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (isReply Structures_H.thread_state.BlockedOnReply);
mdbNode <- liftM cteMDBNode (getCTE (cte_map slot));
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do x <- getCTE (cte_map slot);
y <- assert (mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode x));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. True \<Longrightarrow> no_fail (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) (getCTE (cte_map slot))
 2. \<And>rv. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (cte_wp_at' (\<lambda>c. c = rv) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode rv) \<noteq> nullPointer \<and> mdbNext (cteMDBNode rv) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode rv));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>True; (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 2. \<And>rv. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (cte_wp_at' (\<lambda>c. c = rv) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode rv) \<noteq> nullPointer \<and> mdbNext (cteMDBNode rv) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode rv));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>rv. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (cte_wp_at' (\<lambda>c. c = rv) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode rv) \<noteq> nullPointer \<and> mdbNext (cteMDBNode rv) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode rv));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>mdbnode. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode mdbnode));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode s s'. \<lbrakk>(st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s; (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s
 2. \<And>mdbnode s s'. \<lbrakk>(st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s; (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s' \<and> ?R'96 mdbnode s'
 3. \<And>mdbnode. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (\<lambda>s. (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s \<and> ?R'96 mdbnode s) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode mdbnode));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode s s'. \<lbrakk>(st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s; (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s' \<and> ?R'96 mdbnode s'
 2. \<And>mdbnode. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (\<lambda>s. (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s \<and> ?R'96 mdbnode s) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode mdbnode));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode s s'. \<lbrakk>(st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s; (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?R'96 mdbnode s'
 2. \<And>mdbnode. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (\<lambda>s. (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s \<and> ?R'96 mdbnode s) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode mdbnode));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode s s'. \<lbrakk>(s, s') \<in> state_relation; st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; st_tcb_at' awaiting_reply' receiver s'; valid_list s; invs' s'; valid_sched s; tcb_at' sender s'; tcb_at receiver s; tcb_at' receiver s'; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s; valid_pspace' s'; ctes_of s' (cte_map slot) = Some mdbnode\<rbrakk> \<Longrightarrow> ?R'96 mdbnode s'
 2. \<And>mdbnode. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (\<lambda>s. (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s \<and> ?R'96 mdbnode s) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode mdbnode));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode s s'. \<lbrakk>(s, s') \<in> state_relation; st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; st_tcb_at' awaiting_reply' receiver s'; valid_list s; invs' s'; valid_sched s; tcb_at' sender s'; tcb_at receiver s; tcb_at' receiver s'; tcb_at sender s; valid_pspace' s'; ctes_of s' (cte_map slot) = Some mdbnode; cte_wp_at (is_reply_cap_to receiver) slot s\<rbrakk> \<Longrightarrow> ?R'96 mdbnode s'
 2. \<And>mdbnode. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (\<lambda>s. (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s \<and> ?R'96 mdbnode s) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode mdbnode));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>mdbnode. corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (\<lambda>s. (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s \<and> (mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer);
parentCap <- getSlotCap (mdbPrev (cteMDBNode mdbnode));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>mdbnode. mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer \<Longrightarrow> corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (\<lambda>s. (cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) and (st_tcb_at' awaiting_reply' receiver and (invs' and tcb_at' sender and tcb_at' receiver and valid_pspace' and cte_wp_at' (\<lambda>_. True) (cte_map slot)))) s \<and> (mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do parentCap <- getSlotCap (mdbPrev (cteMDBNode mdbnode));
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>mdbnode. mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer \<Longrightarrow> corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do cte <- getCTE (mdbPrev (cteMDBNode mdbnode));
y <- assert (isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte));
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s) (getCTE (mdbPrev (cteMDBNode mdbnode)))
 2. \<And>mdbnode cte. mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer \<Longrightarrow> corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte));
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; True; cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode mdbnode)) s
 2. \<And>mdbnode cte. mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer \<Longrightarrow> corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte));
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>mdbnode cte. mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer \<Longrightarrow> corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (do y <- assert (isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte));
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)
 2. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)) proof (prove)
goal (1 subgoal):
 1. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> corres dc (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)) proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> corres dc (?Q175 mdbnode cte) (?Q'175 mdbnode cte) (thread_get tcb_fault receiver >>= case_option (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (\<lambda>f. do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od)) (threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od))
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> ?Q175 mdbnode cte s
 3. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> ?Q'175 mdbnode cte s proof (prove)
goal (5 subgoals):
 1. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); fault_rel_optionation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R179 mdbnode cte rv) (?R'179 mdbnode cte rv') (case rv of None \<Rightarrow> do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od | Some f \<Rightarrow> do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply f receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (case rv' of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 2. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>?R179 mdbnode cte\<rbrace>
 3. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>?R'179 mdbnode cte\<rbrace>
 4. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 5. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (6 subgoals):
 1. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> corres dc (?R179 mdbnode cte None) (?R'179 mdbnode cte None) (do y <- do_ipc_transfer sender None 0 grant receiver;
y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od)
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (?R179 mdbnode cte (Some a)) (?R'179 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 3. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>?R179 mdbnode cte\<rbrace>
 4. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>?R'179 mdbnode cte\<rbrace>
 5. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 6. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (8 subgoals):
 1. \<And>mdbnode cte rv rv' y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R187 mdbnode cte rv rv' y) (?R'187 mdbnode cte rv rv' ya) (do y <- cap_delete_one slot;
y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (do y <- cteDeleteOne (cte_map slot);
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od)
 2. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q193 mdbnode cte None\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>?R187 mdbnode cte rv rv'\<rbrace>
 3. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>?R'187 mdbnode cte rv rv'\<rbrace>
 4. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte (Some a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 5. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte a\<rbrace>
 6. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 7. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 8. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (10 subgoals):
 1. \<And>mdbnode cte rv rv' y ya rva rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R198 mdbnode cte rv rv' y ya rva) (?R'198 mdbnode cte rv rv' y ya rv'a) (do y <- set_thread_state receiver Structures_A.thread_state.Running;
possible_switch_to receiver
od) (do y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od)
 2. \<And>mdbnode cte rv rv' y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 mdbnode cte rv rv' y\<rbrace> cap_delete_one slot \<lbrace>?R198 mdbnode cte rv rv' y ya\<rbrace>
 3. \<And>mdbnode cte rv rv' y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 mdbnode cte rv rv' ya\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>?R'198 mdbnode cte rv rv' y ya\<rbrace>
 4. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q193 mdbnode cte None\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>y. einvs and cte_wp_at can_fast_finalise slot and ?Q201 mdbnode cte rv rv' y\<rbrace>
 5. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'203 mdbnode cte rv rv' ya\<rbrace>
 6. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte (Some a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 7. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte a\<rbrace>
 8. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 9. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 10. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (13 subgoals):
 1. \<And>mdbnode cte rv rv' y ya rva rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Running Structures_H.thread_state.Running
 2. \<And>mdbnode cte rv rv' y ya rva rv'a rvb rv'b. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R207 mdbnode cte rv rv' y ya rva rv'a rvb) (?R'207 mdbnode cte rv rv' y ya rva rv'a rv'b) (possible_switch_to receiver) (possibleSwitchTo receiver)
 3. \<And>mdbnode cte rv rv' y ya rva rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q210 mdbnode cte rv rv' y ya rva\<rbrace> set_thread_state receiver Structures_A.thread_state.Running \<lbrace>?R207 mdbnode cte rv rv' y ya rva rv'a\<rbrace>
 4. \<And>mdbnode cte rv rv' y ya rva rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'212 mdbnode cte rv rv' y ya rv'a\<rbrace> setThreadState Structures_H.thread_state.Running receiver \<lbrace>?R'207 mdbnode cte rv rv' y ya rva rv'a\<rbrace>
 5. \<And>mdbnode cte rv rv' y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 mdbnode cte rv rv' y\<rbrace> cap_delete_one slot \<lbrace>\<lambda>rva. tcb_at receiver and ?Q210 mdbnode cte rv rv' y ya rva\<rbrace>
 6. \<And>mdbnode cte rv rv' y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 mdbnode cte rv rv' ya\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>rv'a. tcb_at' receiver and ?Q'212 mdbnode cte rv rv' y ya rv'a\<rbrace>
 7. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q193 mdbnode cte None\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>y. einvs and cte_wp_at can_fast_finalise slot and ?Q201 mdbnode cte rv rv' y\<rbrace>
 8. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'203 mdbnode cte rv rv' ya\<rbrace>
 9. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte (Some a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 10. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>mdbnode cte rv rv' y ya rva rv'a rvb rv'b. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R207 mdbnode cte rv rv' y ya rva rv'a rvb) (?R'207 mdbnode cte rv rv' y ya rva rv'a rv'b) (possible_switch_to receiver) (possibleSwitchTo receiver)
 2. \<And>mdbnode cte rv rv' y ya rva rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q210 mdbnode cte rv rv' y ya rva\<rbrace> set_thread_state receiver Structures_A.thread_state.Running \<lbrace>?R207 mdbnode cte rv rv' y ya rva rv'a\<rbrace>
 3. \<And>mdbnode cte rv rv' y ya rva rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'212 mdbnode cte rv rv' y ya rv'a\<rbrace> setThreadState Structures_H.thread_state.Running receiver \<lbrace>?R'207 mdbnode cte rv rv' y ya rva rv'a\<rbrace>
 4. \<And>mdbnode cte rv rv' y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 mdbnode cte rv rv' y\<rbrace> cap_delete_one slot \<lbrace>\<lambda>rva. tcb_at receiver and ?Q210 mdbnode cte rv rv' y ya rva\<rbrace>
 5. \<And>mdbnode cte rv rv' y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 mdbnode cte rv rv' ya\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>rv'a. tcb_at' receiver and ?Q'212 mdbnode cte rv rv' y ya rv'a\<rbrace>
 6. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q193 mdbnode cte None\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>y. einvs and cte_wp_at can_fast_finalise slot and ?Q201 mdbnode cte rv rv' y\<rbrace>
 7. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'203 mdbnode cte rv rv' ya\<rbrace>
 8. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte (Some a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 9. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte a\<rbrace>
 10. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>mdbnode cte rv rv' y ya rva rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q210 mdbnode cte rv rv' y ya rva\<rbrace> set_thread_state receiver Structures_A.thread_state.Running \<lbrace>\<lambda>rvb. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable receiver\<rbrace>
 2. \<And>mdbnode cte rv rv' y ya rva rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'212 mdbnode cte rv rv' y ya rv'a\<rbrace> setThreadState Structures_H.thread_state.Running receiver \<lbrace>\<lambda>rv'b. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' receiver and st_tcb_at' runnable' receiver and valid_objs'\<rbrace>
 3. \<And>mdbnode cte rv rv' y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 mdbnode cte rv rv' y\<rbrace> cap_delete_one slot \<lbrace>\<lambda>rva. tcb_at receiver and ?Q210 mdbnode cte rv rv' y ya rva\<rbrace>
 4. \<And>mdbnode cte rv rv' y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 mdbnode cte rv rv' ya\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>rv'a. tcb_at' receiver and ?Q'212 mdbnode cte rv rv' y ya rv'a\<rbrace>
 5. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q193 mdbnode cte None\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>y. einvs and cte_wp_at can_fast_finalise slot and ?Q201 mdbnode cte rv rv' y\<rbrace>
 6. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'203 mdbnode cte rv rv' ya\<rbrace>
 7. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte (Some a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 8. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q193 mdbnode cte a\<rbrace>
 9. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 10. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
A total of 11 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 mdbnode cte (ds_id None)\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. cte_wp_at can_fast_finalise slot s \<and> tcb_at receiver s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s\<rbrace>
 2. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' receiver s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' receiver s \<and> valid_objs' s)\<rbrace>
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> ?P'369 mdbnode cte (Some a) b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 4. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> ?P'369 mdbnode cte a aa)\<rbrace>
 5. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 6. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 7. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (7 subgoals):
 1. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 mdbnode cte (ds_id None)\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>r s. cte_wp_at ((=) (cap.ReplyCap (?tcb380 mdbnode cte rv rv' r s) (?v380 mdbnode cte rv rv' r s) (?R380 mdbnode cte rv rv' r s))) slot s \<and> tcb_at receiver s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s\<rbrace>
 2. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' receiver s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' receiver s \<and> valid_objs' s)\<rbrace>
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> ?P'369 mdbnode cte (Some a) b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 4. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> ?P'369 mdbnode cte a aa)\<rbrace>
 5. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 6. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 7. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (8 subgoals):
 1. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P385 mdbnode cte (ds_id None)\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>rva s. cte_wp_at ((=) (cap.ReplyCap (?tcb380 mdbnode cte rv rv' rva s) (?v380 mdbnode cte rv rv' rva s) (?R380 mdbnode cte rv rv' rva s))) slot s\<rbrace>
 2. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'384 mdbnode cte (ds_id None)\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. tcb_at receiver s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s\<rbrace>
 3. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' receiver s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' receiver s \<and> valid_objs' s)\<rbrace>
 4. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> ?P385 mdbnode cte (Some a) b \<and> ?P'384 mdbnode cte (Some a) b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 5. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> ?P385 mdbnode cte a aa \<and> ?P'384 mdbnode cte a aa)\<rbrace>
 6. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 7. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 8. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (9 subgoals):
 1. \<And>mdbnode cte rv rv' c. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; ?P395 mdbnode cte (ds_id None) c\<rbrakk> \<Longrightarrow> \<not> is_untyped_cap c
 2. \<And>mdbnode cte rv rv' rva s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; cte_wp_at (?P395 mdbnode cte (ds_id None) and (\<noteq>) cap.NullCap) (?ptr393 mdbnode cte (ds_id None)) s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (cap.ReplyCap (?tcb380 mdbnode cte rv rv' rva s) (?v380 mdbnode cte rv rv' rva s) (?R380 mdbnode cte rv rv' rva s))) slot s
 3. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'384 mdbnode cte (ds_id None)\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. tcb_at receiver s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s\<rbrace>
 4. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' receiver s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' receiver s \<and> valid_objs' s)\<rbrace>
 5. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at (?P395 mdbnode cte (Some a) and (\<noteq>) cap.NullCap) (?ptr393 mdbnode cte (Some a))) b \<and> ?P'384 mdbnode cte (Some a) b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 6. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> (valid_objs and cte_wp_at (?P395 mdbnode cte a and (\<noteq>) cap.NullCap) (?ptr393 mdbnode cte a)) aa \<and> ?P'384 mdbnode cte a aa)\<rbrace>
 7. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 8. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 9. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (9 subgoals):
 1. \<And>mdbnode cte rv rv' rva s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; cte_wp_at (?P395 mdbnode cte (ds_id None) and (\<noteq>) cap.NullCap) (?ptr393 mdbnode cte (ds_id None)) s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (cap.ReplyCap (?tcb380 mdbnode cte rv rv' rva s) (?v380 mdbnode cte rv rv' rva s) (?R380 mdbnode cte rv rv' rva s))) slot s
 2. \<And>mdbnode cte rv rv' c. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; ?P395 mdbnode cte (ds_id None) c\<rbrakk> \<Longrightarrow> \<not> is_untyped_cap c
 3. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'384 mdbnode cte (ds_id None)\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. tcb_at receiver s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s\<rbrace>
 4. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' receiver s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' receiver s \<and> valid_objs' s)\<rbrace>
 5. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at (?P395 mdbnode cte (Some a) and (\<noteq>) cap.NullCap) (?ptr393 mdbnode cte (Some a))) b \<and> ?P'384 mdbnode cte (Some a) b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 6. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> (valid_objs and cte_wp_at (?P395 mdbnode cte a and (\<noteq>) cap.NullCap) (?ptr393 mdbnode cte a)) aa \<and> ?P'384 mdbnode cte a aa)\<rbrace>
 7. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 8. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 9. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (9 subgoals):
 1. \<And>mdbnode cte rv rv' rva s c. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; (?P395 mdbnode cte (ds_id None) and (\<noteq>) cap.NullCap) c\<rbrakk> \<Longrightarrow> cap.ReplyCap (?tcb380 mdbnode cte rv rv' rva s) (?v380 mdbnode cte rv rv' rva s) (?R380 mdbnode cte rv rv' rva s) = c
 2. \<And>mdbnode cte rv rv' c. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; ?P395 mdbnode cte (ds_id None) c\<rbrakk> \<Longrightarrow> \<not> is_untyped_cap c
 3. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'384 mdbnode cte (ds_id None)\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. tcb_at receiver s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s\<rbrace>
 4. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' receiver s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' receiver s \<and> valid_objs' s)\<rbrace>
 5. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at (?P395 mdbnode cte (Some a) and (\<noteq>) cap.NullCap) slot) b \<and> ?P'384 mdbnode cte (Some a) b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 6. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> (valid_objs and cte_wp_at (?P395 mdbnode cte a and (\<noteq>) cap.NullCap) slot) aa \<and> ?P'384 mdbnode cte a aa)\<rbrace>
 7. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 8. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 9. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s proof (prove)
goal (8 subgoals):
 1. \<And>mdbnode cte rv rv' c. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None; cap.ReplyCap (?tcb415 mdbnode cte (ds_id None)) (?v413 mdbnode cte (ds_id None)) (?R411 mdbnode cte (ds_id None)) = c\<rbrakk> \<Longrightarrow> \<not> is_untyped_cap c
 2. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'384 mdbnode cte (ds_id None)\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. tcb_at receiver s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s\<rbrace>
 3. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' receiver s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' receiver s \<and> valid_objs' s)\<rbrace>
 4. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte (Some a)) (?v413 mdbnode cte (Some a)) (?R411 mdbnode cte (Some a))) and (\<noteq>) cap.NullCap) slot) b \<and> ?P'384 mdbnode cte (Some a) b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 5. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte a) (?v413 mdbnode cte a) (?R411 mdbnode cte a)) and (\<noteq>) cap.NullCap) slot) aa \<and> ?P'384 mdbnode cte a aa)\<rbrace>
 6. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 7. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 8. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s
flex-flex pairs:
\<lambda>mdbnode cte. ?tcb416 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?tcb415 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?v414 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?v413 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?R412 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?R411 mdbnode cte (ds_id None) proof (prove)
goal (7 subgoals):
 1. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'384 mdbnode cte (ds_id None)\<rbrace> do_ipc_transfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. tcb_at receiver s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s\<rbrace>
 2. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'191 mdbnode cte None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>ya. invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' receiver s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' receiver s \<and> valid_objs' s)\<rbrace>
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte (Some a)) (?v413 mdbnode cte (Some a)) (?R411 mdbnode cte (Some a))) and (\<noteq>) cap.NullCap) slot) b \<and> ?P'384 mdbnode cte (Some a) b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte (Some (fault_map a))) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 4. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte a) (?v413 mdbnode cte a) (?R411 mdbnode cte a)) and (\<noteq>) cap.NullCap) slot) aa \<and> ?P'384 mdbnode cte a aa)\<rbrace>
 5. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'191 mdbnode cte a\<rbrace>
 6. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 7. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s
flex-flex pairs:
\<lambda>mdbnode cte. ?tcb416 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?tcb415 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?v414 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?v413 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?R412 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?R411 mdbnode cte (ds_id None) proof (prove)
goal (6 subgoals):
 1. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'497 mdbnode cte (ds_id None)\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. weak_sch_act_wf (ksSchedulerAction s) s \<and> (valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' receiver s \<and> valid_objs' s\<rbrace>
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte (Some a)) (?v413 mdbnode cte (Some a)) (?R411 mdbnode cte (Some a))) and (\<noteq>) cap.NullCap) slot) b \<and> tcb_at receiver b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. (invs' and tcb_at' sender and tcb_at' receiver) b \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) b \<and> tcb_at' receiver b \<and> Invariants_H.valid_queues b \<and> (valid_objs' and valid_mdb') b \<and> ?P'497 mdbnode cte (Some (fault_map a)) b)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 3. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte a) (?v413 mdbnode cte a) (?R411 mdbnode cte a)) and (\<noteq>) cap.NullCap) slot) aa \<and> tcb_at receiver aa \<and> valid_etcbs aa \<and> weak_valid_sched_action aa \<and> cur_tcb aa)\<rbrace>
 4. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>aa. (invs' and tcb_at' sender and tcb_at' receiver) aa \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) aa \<and> tcb_at' receiver aa \<and> Invariants_H.valid_queues aa \<and> (valid_objs' and valid_mdb') aa \<and> ?P'497 mdbnode cte a aa)\<rbrace>
 5. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 6. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s
flex-flex pairs:
\<lambda>mdbnode cte. ?tcb416 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?tcb415 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?v414 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?v413 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?R412 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?R411 mdbnode cte (ds_id None) proof (prove)
goal (6 subgoals):
 1. \<And>mdbnode cte rv rv'. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = None; rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'497 mdbnode cte (ds_id None)\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>_. valid_queues' and valid_objs' and cur_tcb' and tcb_at' receiver and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte (Some a)) (?v413 mdbnode cte (Some a)) (?R411 mdbnode cte (Some a))) and (\<noteq>) cap.NullCap) slot) b \<and> tcb_at receiver b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. (invs' and tcb_at' sender and tcb_at' receiver) b \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) b \<and> tcb_at' receiver b \<and> Invariants_H.valid_queues b \<and> (valid_objs' and valid_mdb') b \<and> ?P'497 mdbnode cte (Some (fault_map a)) b)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 3. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte a) (?v413 mdbnode cte a) (?R411 mdbnode cte a)) and (\<noteq>) cap.NullCap) slot) aa \<and> tcb_at receiver aa \<and> valid_etcbs aa \<and> weak_valid_sched_action aa \<and> cur_tcb aa)\<rbrace>
 4. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>aa. (invs' and tcb_at' sender and tcb_at' receiver) aa \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) aa \<and> tcb_at' receiver aa \<and> Invariants_H.valid_queues aa \<and> (valid_objs' and valid_mdb') aa \<and> ?P'497 mdbnode cte a aa)\<rbrace>
 5. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 6. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s
flex-flex pairs:
\<lambda>mdbnode cte. ?tcb416 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?tcb415 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?v414 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?v413 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?R412 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?R411 mdbnode cte (ds_id None) proof (prove)
goal (5 subgoals):
 1. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte (Some a)) (?v413 mdbnode cte (Some a)) (?R411 mdbnode cte (Some a))) and (\<noteq>) cap.NullCap) slot) b \<and> tcb_at receiver b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 2. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte a) (?v413 mdbnode cte a) (?R411 mdbnode cte a)) and (\<noteq>) cap.NullCap) slot) aa \<and> tcb_at receiver aa \<and> valid_etcbs aa \<and> weak_valid_sched_action aa \<and> cur_tcb aa)\<rbrace>
 3. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)\<rbrace>
 4. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 5. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s
flex-flex pairs:
\<lambda>mdbnode cte. ?tcb416 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?tcb415 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?v414 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?v413 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?R412 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?R411 mdbnode cte (ds_id None) proof (prove)
goal (5 subgoals):
 1. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a. tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>aa. (invs and tcb_at receiver and tcb_at sender) aa \<and> valid_list aa \<and> valid_sched aa \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte a) (?v413 mdbnode cte a) (?R411 mdbnode cte a)) and (\<noteq>) cap.NullCap) slot) aa \<and> tcb_at receiver aa \<and> valid_etcbs aa \<and> weak_valid_sched_action aa \<and> cur_tcb aa)\<rbrace>
 2. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)\<rbrace>
 3. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 4. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s
 5. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte (Some a)) (?v413 mdbnode cte (Some a)) (?R411 mdbnode cte (Some a))) and (\<noteq>) cap.NullCap) slot) b \<and> tcb_at receiver b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
flex-flex pairs:
\<lambda>mdbnode cte. ?tcb416 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?tcb415 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?v414 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?v413 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?R412 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?R411 mdbnode cte (ds_id None) proof (prove)
goal (5 subgoals):
 1. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q179 mdbnode cte\<rbrace> thread_get tcb_fault receiver \<lbrace>\<lambda>a b. tcb_at sender b \<and> tcb_at receiver b \<and> valid_objs b \<and> pspace_aligned b \<and> valid_list b \<and> pspace_distinct b \<and> valid_mdb b \<and> cur_tcb b \<and> invs b \<and> tcb_at receiver b \<and> tcb_at sender b \<and> valid_list b \<and> valid_sched b \<and> valid_objs b \<and> cte_wp_at (\<lambda>b. cap.ReplyCap (?tcb415 mdbnode cte a) (?v413 mdbnode cte a) (?R411 mdbnode cte a) = b \<and> cap.NullCap \<noteq> b) slot b \<and> tcb_at receiver b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b\<rbrace>
 2. \<And>mdbnode cte. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'179 mdbnode cte\<rbrace> threadGet tcbFault receiver \<lbrace>\<lambda>a. tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)\<rbrace>
 3. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q179 mdbnode cte) s
 4. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'179 mdbnode cte) s
 5. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (invs and tcb_at receiver and tcb_at sender) b \<and> valid_list b \<and> valid_sched b \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb415 mdbnode cte (Some a)) (?v413 mdbnode cte (Some a)) (?R411 mdbnode cte (Some a))) and (\<noteq>) cap.NullCap) slot) b \<and> tcb_at receiver b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
flex-flex pairs:
\<lambda>mdbnode cte. ?tcb416 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?tcb415 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?v414 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?v413 mdbnode cte (ds_id None)
\<lambda>mdbnode cte. ?R412 mdbnode cte None None () \<equiv>\<^sup>? \<lambda>mdbnode cte. ?R411 mdbnode cte (ds_id None) proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver and (einvs and tcb_at receiver and tcb_at sender and cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot)) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and (\<lambda>a. tcb_at sender a \<and> tcb_at receiver a \<and> valid_objs a \<and> pspace_aligned a \<and> valid_list a \<and> pspace_distinct a \<and> valid_mdb a \<and> cur_tcb a \<and> invs a \<and> tcb_at receiver a \<and> tcb_at sender a \<and> valid_list a \<and> valid_sched a \<and> valid_objs a \<and> cte_wp_at (\<lambda>a. cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ()) = a \<and> cap.NullCap \<noteq> a) slot a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ())) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s\<rbrakk> \<Longrightarrow> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> valid_objs s \<and> cte_wp_at (\<lambda>a. cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ()) = a \<and> cap.NullCap \<noteq> a) slot s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ())) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> valid_objs s \<and> cte_wp_at (\<lambda>a. cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ()) = a \<and> cap.NullCap \<noteq> a) slot s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ())) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ()) = a \<and> cap.NullCap \<noteq> a) slot s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ())) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ()) = a \<and> cap.NullCap \<noteq> a) slot s
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s
 3. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 4. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ())) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte s c. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cap.ReplyCap receiver False rights = c\<rbrakk> \<Longrightarrow> cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ()) = c \<and> cap.NullCap \<noteq> c
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s
 3. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 4. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ())) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s\<rbrakk> \<Longrightarrow> ?tcb416 mdbnode cte None None () = receiver \<and> \<not> ?v414 mdbnode cte None None () \<and> ?R412 mdbnode cte None None () = rights
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s
 3. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 4. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap (?tcb416 mdbnode cte None None ()) (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ())) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s\<rbrakk> \<Longrightarrow> \<not> ?v414 mdbnode cte None None () \<and> ?R412 mdbnode cte None None () = rights
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s
 3. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 4. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver (?v414 mdbnode cte None None ()) (?R412 mdbnode cte None None ())) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); st_tcb_at ((=) Structures_A.thread_state.BlockedOnReply) receiver s; invs s; valid_list s; valid_sched s; tcb_at receiver s; tcb_at sender s; cte_wp_at ((=) (cap.ReplyCap receiver False rights)) slot s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); (cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) and (\<lambda>s. cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a))) s
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); cte_wp_at' (\<lambda>c. c = cte) (mdbPrev (cteMDBNode mdbnode)) s \<and> cte_wp_at' (\<lambda>c. c = mdbnode) (cte_map slot) s \<and> st_tcb_at' awaiting_reply' receiver s \<and> invs' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode mdbnode)) s\<rbrakk> \<Longrightarrow> cur_tcb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> valid_queues' s \<and> valid_objs' s \<and> valid_mdb' s \<and> cur_tcb' s \<and> sch_act_wf (ksSchedulerAction s) s
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (1 subgoal):
 1. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> corres dc (?Q667 mdbnode cte rv rv' a) (?Q'667 mdbnode cte rv rv' a) (do y <- cap_delete_one slot;
mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do y <- cteDeleteOne (cte_map slot);
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 2. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> ?Q667 mdbnode cte rv rv' a s
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> ?Q'667 mdbnode cte rv rv' a s proof (prove)
goal (5 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R671 mdbnode cte rv rv' a y) (?R'671 mdbnode cte rv rv' a ya) (do mi <- get_message_info sender;
buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply (fault_map a) receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q671 mdbnode cte rv rv' a\<rbrace> cap_delete_one slot \<lbrace>?R671 mdbnode cte rv rv' a\<rbrace>
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>?R'671 mdbnode cte rv rv' a\<rbrace>
 4. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and ?Q671 mdbnode cte rv rv' a) s
 5. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (7 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R676 mdbnode cte rv rv' a y ya mi) (?R'676 mdbnode cte rv rv' a y ya (message_info_map mi)) (do buf <- lookup_ipc_buffer False sender;
mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer (message_info_map mi);
restart <- handleFaultReply (fault_map a) receiver (msgLabel (message_info_map mi)) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 2. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>?R676 mdbnode cte rv rv' a y ya\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'681 mdbnode cte rv rv' a ya\<rbrace> getMessageInfo sender \<lbrace>?R'676 mdbnode cte rv rv' a y ya\<rbrace>
 4. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q671 mdbnode cte rv rv' a\<rbrace> cap_delete_one slot \<lbrace>\<lambda>y. tcb_at sender and ?Q679 mdbnode cte rv rv' a y\<rbrace>
 5. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and ?Q'681 mdbnode cte rv rv' a ya\<rbrace>
 6. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and ?Q671 mdbnode cte rv rv' a) s
 7. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (9 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R685 mdbnode cte rv rv' a y ya mi buf) (?R'685 mdbnode cte rv rv' a y ya mi buf) (do mrs <- get_mrs sender buf mi;
restart <- handle_fault_reply a receiver (mi_label mi) mrs;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do mrs <- getMRs sender buf (message_info_map mi);
restart <- handleFaultReply (fault_map a) receiver (msgLabel (message_info_map mi)) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 2. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>?R685 mdbnode cte rv rv' a y ya mi\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>?R'685 mdbnode cte rv rv' a y ya mi\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'681 mdbnode cte rv rv' a ya\<rbrace> getMessageInfo sender \<lbrace>\<lambda>b. tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'688 mdbnode cte rv rv' a y ya b\<rbrace>
 6. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q671 mdbnode cte rv rv' a\<rbrace> cap_delete_one slot \<lbrace>\<lambda>y. tcb_at sender and ?Q679 mdbnode cte rv rv' a y\<rbrace>
 7. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and ?Q'681 mdbnode cte rv rv' a ya\<rbrace>
 8. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and ?Q671 mdbnode cte rv rv' a) s
 9. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (11 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R692 mdbnode cte rv rv' a y ya mi buf rva) (?R'692 mdbnode cte rv rv' a y ya mi buf rva) (do restart <- handle_fault_reply a receiver (mi_label mi) rva;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do restart <- handleFaultReply (fault_map a) receiver (msgLabel (message_info_map mi)) rva;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 2. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>?R692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>?R'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'681 mdbnode cte rv rv' a ya\<rbrace> getMessageInfo sender \<lbrace>\<lambda>b. tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'688 mdbnode cte rv rv' a y ya b\<rbrace>
 8. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q671 mdbnode cte rv rv' a\<rbrace> cap_delete_one slot \<lbrace>\<lambda>y. tcb_at sender and ?Q679 mdbnode cte rv rv' a y\<rbrace>
 9. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and ?Q'681 mdbnode cte rv rv' a ya\<rbrace>
 10. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and ?Q671 mdbnode cte rv rv' a) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R692 mdbnode cte rv rv' a () () mi buf rva) (?R'692 mdbnode cte rv rv' a () () mi buf rva) (do restart <- handle_fault_reply a receiver (mi_label mi) rva;
y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if restart then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when restart (possible_switch_to receiver)
od) (do restart <- handleFaultReply (fault_map a) receiver (mi_label mi) rva;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 2. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>?R692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>?R'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'681 mdbnode cte rv rv' a ya\<rbrace> getMessageInfo sender \<lbrace>\<lambda>b. tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'688 mdbnode cte rv rv' a y ya b\<rbrace>
 8. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q671 mdbnode cte rv rv' a\<rbrace> cap_delete_one slot \<lbrace>\<lambda>y. tcb_at sender and ?Q679 mdbnode cte rv rv' a y\<rbrace>
 9. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and ?Q'681 mdbnode cte rv rv' a ya\<rbrace>
 10. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and ?Q671 mdbnode cte rv rv' a) s
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> fault_map a = fault_map a
 2. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R697 mdbnode cte rv rv' a y ya mi buf rva rvb) (?R'697 mdbnode cte rv rv' a y ya mi buf rva rvb) (do y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if rvb then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when rvb (possible_switch_to receiver)
od) (do y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if rvb then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 3. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>?R697 mdbnode cte rv rv' a y ya mi buf rva\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>?R'697 mdbnode cte rv rv' a y ya mi buf rva\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'681 mdbnode cte rv rv' a ya\<rbrace> getMessageInfo sender \<lbrace>\<lambda>b. tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'688 mdbnode cte rv rv' a y ya b\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R697 mdbnode cte rv rv' a y ya mi buf rva rvb) (?R'697 mdbnode cte rv rv' a y ya mi buf rva rvb) (do y <- thread_set (tcb_fault_update (\<lambda>_. None)) receiver;
y <- set_thread_state receiver (if rvb then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when rvb (possible_switch_to receiver)
od) (do y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if rvb then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
 2. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>?R697 mdbnode cte rv rv' a y ya mi buf rva\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>?R'697 mdbnode cte rv rv' a y ya mi buf rva\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'681 mdbnode cte rv rv' a ya\<rbrace> getMessageInfo sender \<lbrace>\<lambda>b. tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'688 mdbnode cte rv rv' a y ya b\<rbrace>
 10. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q671 mdbnode cte rv rv' a\<rbrace> cap_delete_one slot \<lbrace>\<lambda>y. tcb_at sender and ?Q679 mdbnode cte rv rv' a y\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> corres (?r'709 mdbnode cte rv rv' a y ya mi buf rva rvb) (?P709 mdbnode cte rv rv' a y ya mi buf rva rvb) (?P'709 mdbnode cte rv rv' a y ya mi buf rva rvb) (thread_set (tcb_fault_update (\<lambda>_. None)) receiver) (threadSet (tcbFault_update (\<lambda>_. None)) receiver)
 2. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb rvc rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya; ?r'709 mdbnode cte rv rv' a y ya mi buf rva rvb rvc rv'a\<rbrakk> \<Longrightarrow> corres dc (?R709 mdbnode cte rv rv' a y ya mi buf rva rvb rvc) (?R'709 mdbnode cte rv rv' a y ya mi buf rva rvb rv'a) (do y <- set_thread_state receiver (if rvb then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when rvb (possible_switch_to receiver)
od) (if rvb then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver)
 3. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>?R709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?R'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. ?P709 mdbnode cte rv rv' a y ya mi buf rva rvb and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. ?P'709 mdbnode cte rv rv' a y ya mi buf rva rvb and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb rvc rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya; dc rvc rv'a\<rbrakk> \<Longrightarrow> corres dc (?R709 mdbnode cte rv rv' a y ya mi buf rva rvb rvc) (?R'709 mdbnode cte rv rv' a y ya mi buf rva rvb rv'a) (do y <- set_thread_state receiver (if rvb then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when rvb (possible_switch_to receiver)
od) (if rvb then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver)
 2. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>?R709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?R'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb rvc rv'a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya; dc rvc rv'a\<rbrakk> \<Longrightarrow> corres dc (valid_sched and cur_tcb and tcb_at receiver) (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') (do y <- set_thread_state receiver (if rvb then Structures_A.thread_state.Restart else Structures_A.thread_state.Inactive);
when rvb (possible_switch_to receiver)
od) (if rvb then do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver)
 2. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (valid_sched and cur_tcb and tcb_at receiver) (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') (do y <- set_thread_state receiver Structures_A.thread_state.Restart;
possible_switch_to receiver
od) (do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od)
 2. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (valid_sched and cur_tcb and tcb_at receiver) (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') (set_thread_state receiver Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive receiver)
 3. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?Q733 mdbnode cte rv rv' a rvb) (?Q'733 mdbnode cte rv rv' a rvb) (do y <- set_thread_state receiver Structures_A.thread_state.Restart;
possible_switch_to receiver
od) (do y <- setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od)
 2. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (valid_sched and cur_tcb and tcb_at receiver) s\<rbrakk> \<Longrightarrow> ?Q733 mdbnode cte rv rv' a rvb s
 3. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') s\<rbrakk> \<Longrightarrow> ?Q'733 mdbnode cte rv rv' a rvb s
 4. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (valid_sched and cur_tcb and tcb_at receiver) (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') (set_thread_state receiver Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive receiver)
 5. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
A total of 18 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Restart Structures_H.thread_state.Restart
 2. \<And>mdbnode cte rv rv' a rvb y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R737 mdbnode cte rv rv' a rvb y) (?R'737 mdbnode cte rv rv' a rvb ya) (possible_switch_to receiver) (possibleSwitchTo receiver)
 3. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> \<lbrace>?Q737 mdbnode cte rv rv' a rvb\<rbrace> set_thread_state receiver Structures_A.thread_state.Restart \<lbrace>?R737 mdbnode cte rv rv' a rvb\<rbrace>
 4. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'737 mdbnode cte rv rv' a rvb\<rbrace> setThreadState Structures_H.thread_state.Restart receiver \<lbrace>?R'737 mdbnode cte rv rv' a rvb\<rbrace>
 5. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (valid_sched and cur_tcb and tcb_at receiver) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q737 mdbnode cte rv rv' a rvb) s
 6. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'737 mdbnode cte rv rv' a rvb) s
 7. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (valid_sched and cur_tcb and tcb_at receiver) (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') (set_thread_state receiver Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive receiver)
 8. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>mdbnode cte rv rv' a rvb y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R737 mdbnode cte rv rv' a rvb y) (?R'737 mdbnode cte rv rv' a rvb ya) (possible_switch_to receiver) (possibleSwitchTo receiver)
 2. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> \<lbrace>?Q737 mdbnode cte rv rv' a rvb\<rbrace> set_thread_state receiver Structures_A.thread_state.Restart \<lbrace>?R737 mdbnode cte rv rv' a rvb\<rbrace>
 3. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'737 mdbnode cte rv rv' a rvb\<rbrace> setThreadState Structures_H.thread_state.Restart receiver \<lbrace>?R'737 mdbnode cte rv rv' a rvb\<rbrace>
 4. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (valid_sched and cur_tcb and tcb_at receiver) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q737 mdbnode cte rv rv' a rvb) s
 5. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'737 mdbnode cte rv rv' a rvb) s
 6. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (valid_sched and cur_tcb and tcb_at receiver) (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') (set_thread_state receiver Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive receiver)
 7. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> \<lbrace>?Q737 mdbnode cte rv rv' a rvb\<rbrace> set_thread_state receiver Structures_A.thread_state.Restart \<lbrace>\<lambda>y. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable receiver\<rbrace>
 2. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'737 mdbnode cte rv rv' a rvb\<rbrace> setThreadState Structures_H.thread_state.Restart receiver \<lbrace>\<lambda>ya. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' receiver and st_tcb_at' runnable' receiver and valid_objs'\<rbrace>
 3. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (valid_sched and cur_tcb and tcb_at receiver) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q737 mdbnode cte rv rv' a rvb) s
 4. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'737 mdbnode cte rv rv' a rvb) s
 5. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb\<rbrakk> \<Longrightarrow> corres dc (valid_sched and cur_tcb and tcb_at receiver) (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') (set_thread_state receiver Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive receiver)
 6. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> \<lbrace>?Q737 mdbnode cte (Some a) (Some (fault_map a)) a True\<rbrace> set_thread_state receiver Structures_A.thread_state.Restart \<lbrace>\<lambda>y. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable receiver\<rbrace>
 2. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'737 mdbnode cte rv rv' a rvb\<rbrace> setThreadState Structures_H.thread_state.Restart receiver \<lbrace>\<lambda>ya. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' receiver and st_tcb_at' runnable' receiver and valid_objs'\<rbrace>
 3. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (valid_sched and cur_tcb and tcb_at receiver) s\<rbrakk> \<Longrightarrow> (tcb_at receiver and ?Q737 mdbnode cte rv rv' a rvb) s
 4. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; rvb; (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and ?Q'737 mdbnode cte rv rv' a rvb) s
 5. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb\<rbrakk> \<Longrightarrow> corres dc (valid_sched and cur_tcb and tcb_at receiver) (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') (set_thread_state receiver Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive receiver)
 6. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
A total of 19 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb\<rbrakk> \<Longrightarrow> corres dc (valid_sched and cur_tcb and tcb_at receiver) (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') (set_thread_state receiver Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive receiver)
 2. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb\<rbrakk> \<Longrightarrow> corres dc (?Q814 mdbnode cte rv rv' a rvb) (?Q'814 mdbnode cte rv rv' a rvb) (set_thread_state receiver Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive receiver)
 2. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb; (valid_sched and cur_tcb and tcb_at receiver) s\<rbrakk> \<Longrightarrow> ?Q814 mdbnode cte rv rv' a rvb s
 3. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb; (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') s\<rbrakk> \<Longrightarrow> ?Q'814 mdbnode cte rv rv' a rvb s
 4. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>mdbnode cte rv rv' a rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Inactive Structures_H.thread_state.Inactive
 2. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb; (valid_sched and cur_tcb and tcb_at receiver) s\<rbrakk> \<Longrightarrow> tcb_at receiver s
 3. \<And>mdbnode cte rv rv' a rvb s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; \<not> rvb; (tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs') s\<rbrakk> \<Longrightarrow> tcb_at' receiver s
 4. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
A total of 17 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>mdbnode cte a mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 mdbnode cte (Some a) (Some (fault_map a)) a () () mi buf rva rvb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rvc. valid_sched and cur_tcb and tcb_at receiver\<rbrace>
 2. \<And>mdbnode cte rv rv' a y ya mi buf rva rvb. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv'a. tcb_at' receiver and cur_tcb' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and Invariants_H.valid_queues and valid_queues' and valid_objs'\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q703 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handle_fault_reply a receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at receiver and ?Q709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'701 mdbnode cte rv rv' a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rvb. tcb_at' receiver and ?Q'709 mdbnode cte rv rv' a y ya mi buf rva rvb\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>b. tcb_at receiver and ?Q703 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and ?Q'701 mdbnode cte rv rv' a y ya mi buf b\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 8. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 9. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
 10. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'681 mdbnode cte rv rv' a ya\<rbrace> getMessageInfo sender \<lbrace>\<lambda>b. tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'688 mdbnode cte rv rv' a y ya b\<rbrace>
A total of 14 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>mdbnode cte rv rv' a mi buf rva. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?P'923 mdbnode cte (Some a) (Some (fault_map a)) a () () mi buf rva\<rbrace> handleFaultReply (fault_map a) receiver (mi_label mi) rva \<lbrace>\<lambda>rv s. (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) receiver s \<longrightarrow> receiver \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko qdom prio. ko_at' ko receiver s \<and> inQ qdom prio (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ qdom prio ko \<longrightarrow> receiver \<in> set (ksReadyQueues s (qdom, prio))) \<and> valid_queues' s \<and> valid_objs' s\<rbrace>
 2. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace> get_mrs sender buf mi \<lbrace>\<lambda>a. tcb_at receiver and (\<lambda>a. tcb_at receiver a \<and> valid_sched a \<and> cur_tcb a \<and> tcb_at receiver a)\<rbrace>
 3. \<And>mdbnode cte rv rv' a y ya mi buf. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace> getMRs sender buf (message_info_map mi) \<lbrace>\<lambda>b. tcb_at' receiver and (\<lambda>c. tcb_at' receiver c \<and> tcb_at' receiver c \<and> cur_tcb' c \<and> weak_sch_act_wf (ksSchedulerAction c) c \<and> Invariants_H.valid_queues c \<and> ?P'923 mdbnode cte rv rv' a y ya mi buf b c)\<rbrace>
 4. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q685 mdbnode cte rv rv' a y ya mi\<rbrace> lookup_ipc_buffer False sender \<lbrace>\<lambda>buf. tcb_at sender and ?Q692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 5. \<And>mdbnode cte rv rv' a y ya mi. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'688 mdbnode cte rv rv' a y ya (message_info_map mi)\<rbrace> lookupIPCBuffer False sender \<lbrace>\<lambda>buf. tcb_at' sender and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'692 mdbnode cte rv rv' a y ya mi buf\<rbrace>
 6. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q679 mdbnode cte rv rv' a y\<rbrace> get_message_info sender \<lbrace>\<lambda>mi. tcb_at sender and valid_objs and pspace_aligned and ?Q685 mdbnode cte rv rv' a y ya mi\<rbrace>
 7. \<And>mdbnode cte rv rv' a y ya. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'681 mdbnode cte rv rv' a ya\<rbrace> getMessageInfo sender \<lbrace>\<lambda>b. tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'688 mdbnode cte rv rv' a y ya b\<rbrace>
 8. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q671 mdbnode cte rv rv' a\<rbrace> cap_delete_one slot \<lbrace>\<lambda>y. tcb_at sender and ?Q679 mdbnode cte rv rv' a y\<rbrace>
 9. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and ?Q'681 mdbnode cte rv rv' a ya\<rbrace>
 10. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and ?Q671 mdbnode cte rv rv' a) s
A total of 11 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?P'976 mdbnode cte (Some a) (Some (fault_map a)) a\<rbrace> cap_delete_one slot \<lbrace>\<lambda>rv s. valid_objs s \<and> pspace_aligned s \<and> tcb_at sender s \<and> tcb_at receiver s \<and> valid_sched s \<and> cur_tcb s \<and> tcb_at receiver s\<rbrace>
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and (tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. tcb_at' sender a \<and> valid_objs' a \<and> (tcb_at' receiver and (\<lambda>a. tcb_at' receiver a \<and> tcb_at' receiver a \<and> cur_tcb' a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> valid_objs' a)) a))\<rbrace>
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> ?P'976 mdbnode cte rv rv' a s)) s
 4. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?P'976 mdbnode cte (Some a) (Some (fault_map a)) a\<rbrace> cap_delete_one slot \<lbrace>\<lambda>_. valid_sched and cur_tcb and tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned\<rbrace>
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and (tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. tcb_at' sender a \<and> valid_objs' a \<and> (tcb_at' receiver and (\<lambda>a. tcb_at' receiver a \<and> tcb_at' receiver a \<and> cur_tcb' a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> valid_objs' a)) a))\<rbrace>
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> ?P'976 mdbnode cte rv rv' a s)) s
 4. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?P'1013 mdbnode cte (Some a) (Some (fault_map a)) a\<rbrace> cap_delete_one slot \<lbrace>\<lambda>rv s. valid_objs s \<and> pspace_aligned s\<rbrace>
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and (tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. tcb_at' sender a \<and> valid_objs' a \<and> (tcb_at' receiver and (\<lambda>a. tcb_at' receiver a \<and> tcb_at' receiver a \<and> cur_tcb' a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> valid_objs' a)) a))\<rbrace>
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> valid_sched s \<and> cur_tcb s \<and> tcb_at sender s \<and> tcb_at receiver s \<and> ?P'1013 mdbnode cte rv rv' a s)) s
 4. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (5 subgoals):
 1. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; ?P'1013 mdbnode cte (Some a) (Some (fault_map a)) a s\<rbrakk> \<Longrightarrow> (invs and emptyable slot) s
 2. \<And>mdbnode cte rv rv' a rva s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; invs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> pspace_aligned s
 3. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and (tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. tcb_at' sender a \<and> valid_objs' a \<and> (tcb_at' receiver and (\<lambda>a. tcb_at' receiver a \<and> tcb_at' receiver a \<and> cur_tcb' a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> valid_objs' a)) a))\<rbrace>
 4. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> valid_sched s \<and> cur_tcb s \<and> tcb_at sender s \<and> tcb_at receiver s \<and> ?P'1013 mdbnode cte rv rv' a s)) s
 5. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte rv rv' a rva s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; invs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> pspace_aligned s
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and (tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. tcb_at' sender a \<and> valid_objs' a \<and> (tcb_at' receiver and (\<lambda>a. tcb_at' receiver a \<and> tcb_at' receiver a \<and> cur_tcb' a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> valid_objs' a)) a))\<rbrace>
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> valid_sched s \<and> cur_tcb s \<and> tcb_at sender s \<and> tcb_at receiver s \<and> (invs and emptyable slot) s)) s
 4. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte rv rv' a rva s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; invs s\<rbrakk> \<Longrightarrow> pspace_aligned s
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and (tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. tcb_at' sender a \<and> valid_objs' a \<and> (tcb_at' receiver and (\<lambda>a. tcb_at' receiver a \<and> tcb_at' receiver a \<and> cur_tcb' a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> valid_objs' a)) a))\<rbrace>
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> valid_sched s \<and> cur_tcb s \<and> tcb_at sender s \<and> tcb_at receiver s \<and> (invs and emptyable slot) s)) s
 4. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>ya. tcb_at' sender and (tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. tcb_at' sender a \<and> valid_objs' a \<and> (tcb_at' receiver and (\<lambda>a. tcb_at' receiver a \<and> tcb_at' receiver a \<and> cur_tcb' a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> valid_objs' a)) a))\<rbrace>
 2. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> valid_sched s \<and> cur_tcb s \<and> tcb_at sender s \<and> tcb_at receiver s \<and> (invs and emptyable slot) s)) s
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (4 subgoals):
 1. \<And>mdbnode cte rv rv' a rva s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and invs') s\<rbrakk> \<Longrightarrow> (tcb_at' sender and (tcb_at' sender and valid_objs' and pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. tcb_at' sender a \<and> valid_objs' a \<and> (tcb_at' receiver and (\<lambda>a. tcb_at' receiver a \<and> tcb_at' receiver a \<and> cur_tcb' a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> valid_objs' a)) a))) s
 2. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>_. tcb_at' sender and tcb_at' receiver and invs'\<rbrace>
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> valid_sched s \<and> cur_tcb s \<and> tcb_at sender s \<and> tcb_at receiver s \<and> (invs and emptyable slot) s)) s
 4. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte rv rv' a. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'671 mdbnode cte rv rv' a\<rbrace> cteDeleteOne (cte_map slot) \<lbrace>\<lambda>_. tcb_at' sender and tcb_at' receiver and invs'\<rbrace>
 2. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> valid_sched s \<and> cur_tcb s \<and> tcb_at sender s \<and> tcb_at receiver s \<and> (invs and emptyable slot) s)) s
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'671 mdbnode cte rv rv' a) s proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at sender and tcb_at receiver and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>a. (invs and tcb_at receiver and tcb_at sender) a \<and> valid_list a \<and> valid_sched a \<and> (valid_objs and cte_wp_at ((=) (cap.ReplyCap receiver False rights) and (\<noteq>) cap.NullCap) slot) a \<and> tcb_at receiver a \<and> valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a)) s\<rbrakk> \<Longrightarrow> (einvs and cte_wp_at can_fast_finalise slot and (\<lambda>s. tcb_at sender s \<and> tcb_at sender s \<and> valid_sched s \<and> cur_tcb s \<and> tcb_at sender s \<and> tcb_at receiver s \<and> (invs and emptyable slot) s)) s
 2. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' sender s \<and> tcb_at' receiver s \<and> invs' s)) s proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); pspace_aligned s; pspace_distinct s; valid_mdb s; invs s; tcb_at sender s; valid_list s; valid_sched s; valid_objs s; cte_wp_at (\<lambda>a. cap.ReplyCap receiver False rights = a \<and> cap.NullCap \<noteq> a) slot s; tcb_at receiver s; valid_etcbs s; weak_valid_sched_action s; cur_tcb s\<rbrakk> \<Longrightarrow> cte_wp_at can_fast_finalise slot s \<and> emptyable slot s
 2. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' sender s \<and> tcb_at' receiver s \<and> invs' s)) s proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); pspace_aligned s; pspace_distinct s; valid_mdb s; invs s; tcb_at sender s; valid_list s; valid_sched s; valid_objs s; cte_wp_at (\<lambda>a. cap.ReplyCap receiver False rights = a \<and> cap.NullCap \<noteq> a) slot s; tcb_at receiver s; valid_etcbs s; weak_valid_sched_action s; cur_tcb s\<rbrakk> \<Longrightarrow> cte_wp_at can_fast_finalise slot s
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); pspace_aligned s; pspace_distinct s; valid_mdb s; invs s; tcb_at sender s; valid_list s; valid_sched s; valid_objs s; cte_wp_at (\<lambda>a. cap.ReplyCap receiver False rights = a \<and> cap.NullCap \<noteq> a) slot s; tcb_at receiver s; valid_etcbs s; weak_valid_sched_action s; cur_tcb s\<rbrakk> \<Longrightarrow> emptyable slot s
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' sender s \<and> tcb_at' receiver s \<and> invs' s)) s proof (prove)
goal (3 subgoals):
 1. \<And>mdbnode cte s c. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); pspace_aligned s; pspace_distinct s; valid_mdb s; invs s; tcb_at sender s; valid_list s; valid_sched s; valid_objs s; tcb_at receiver s; valid_etcbs s; weak_valid_sched_action s; cur_tcb s; cap.ReplyCap receiver False rights = c \<and> cap.NullCap \<noteq> c\<rbrakk> \<Longrightarrow> can_fast_finalise c
 2. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); pspace_aligned s; pspace_distinct s; valid_mdb s; invs s; tcb_at sender s; valid_list s; valid_sched s; valid_objs s; cte_wp_at (\<lambda>a. cap.ReplyCap receiver False rights = a \<and> cap.NullCap \<noteq> a) slot s; tcb_at receiver s; valid_etcbs s; weak_valid_sched_action s; cur_tcb s\<rbrakk> \<Longrightarrow> emptyable slot s
 3. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' sender s \<and> tcb_at' receiver s \<and> invs' s)) s proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); pspace_aligned s; pspace_distinct s; valid_mdb s; invs s; tcb_at sender s; valid_list s; valid_sched s; valid_objs s; cte_wp_at (\<lambda>a. cap.ReplyCap receiver False rights = a \<and> cap.NullCap \<noteq> a) slot s; tcb_at receiver s; valid_etcbs s; weak_valid_sched_action s; cur_tcb s\<rbrakk> \<Longrightarrow> emptyable slot s
 2. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' sender s \<and> tcb_at' receiver s \<and> invs' s)) s proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode cte s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); pspace_aligned s; pspace_distinct s; valid_mdb s; invs s; tcb_at sender s; valid_list s; valid_sched s; valid_objs s; tcb_at receiver s; valid_etcbs s; weak_valid_sched_action s; cur_tcb s\<rbrakk> \<Longrightarrow> \<forall>cap. cap.ReplyCap receiver False rights = cap \<and> cap.NullCap \<noteq> cap \<longrightarrow> \<not> is_master_reply_cap cap
 2. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' sender s \<and> tcb_at' receiver s \<and> invs' s)) s proof (prove)
goal (2 subgoals):
 1. \<And>mdbnode cte s cap. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer; mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); pspace_aligned s; pspace_distinct s; valid_mdb s; invs s; tcb_at sender s; valid_list s; valid_sched s; valid_objs s; tcb_at receiver s; valid_etcbs s; weak_valid_sched_action s; cur_tcb s; cap.ReplyCap receiver False rights = cap \<and> cap.NullCap \<noteq> cap\<rbrakk> \<Longrightarrow> \<not> is_master_reply_cap cap
 2. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' sender s \<and> tcb_at' receiver s \<and> invs' s)) s proof (prove)
goal (1 subgoal):
 1. \<And>mdbnode cte rv rv' a s. \<lbrakk>mdbPrev (cteMDBNode mdbnode) \<noteq> nullPointer \<and> mdbNext (cteMDBNode mdbnode) = nullPointer; isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte); rv' = Some (fault_map a); rv = Some a; (tcb_at' sender and tcb_at' receiver and valid_pspace' and cur_tcb' and (\<lambda>s. case None of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_mdb') a \<and> valid_queues' a \<and> (valid_objs' and valid_mdb') a \<and> cur_tcb' a \<and> tcb_at' receiver a \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. tcb_at' sender s \<and> tcb_at' receiver s \<and> invs' s)) s proof (prove)
goal:
No subgoals!