theory Fastpath_Equiv

lemma fastpath_callKernel_SysCall_corres:
  "monadic_rewrite True False
         (invs' and ct_in_state' ((=) Running)
                and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)
                and (\<lambda>s. ksDomainTime s \<noteq> 0))
     (callKernel (SyscallEvent SysCall)) (fastpaths SysCall)" supply if_cong[cong] option.case_cong[cong] if_split[split del] supply empty_fail_getMRs[wp]  (* FIXME *)
   supply empty_fail_getEndpoint[wp]  (* FIXME *)
   apply (rule monadic_rewrite_introduce_alternative[OF callKernel_def[simplified atomize_eq]]) apply (rule monadic_rewrite_guard_imp) apply (rule monadic_rewrite_bind_alternative_l, wpsimp) apply (rule monadic_rewrite_stateAssert) apply (simp add: handleEvent_def handleCall_def
                    handleInvocation_def liftE_bindE_handle
                    bind_assoc getMessageInfo_def) apply (simp add: catch_liftE_bindE unlessE_throw_catch_If
                    unifyFailure_catch_If catch_liftE
                    getMessageInfo_def alternative_bind
                    fastpaths_def
              cong: if_cong) apply (rule monadic_rewrite_bind_alternative_l, wp) apply (rule monadic_rewrite_bind_tail) apply (rule monadic_rewrite_bind_alternative_l, wp) apply (rule monadic_rewrite_bind_tail) apply (rename_tac msgInfo) apply (rule monadic_rewrite_bind_alternative_l, wp) apply (rule monadic_rewrite_bind_tail) apply monadic_rewrite_symb_exec_r apply (rename_tac tcbFault) apply (rule monadic_rewrite_alternative_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (simp add: split_def Syscall_H.syscall_def
                        liftE_bindE_handle bind_assoc
                        capFaultOnFailure_def) apply (simp only: bindE_bind_linearise[where f="rethrowFailure fn f'" for fn f']
                         bind_case_sum_rethrow) apply (simp add: lookupCapAndSlot_def
                        lookupSlotForThread_def bindE_assoc
                        liftE_bind_return_bindE_returnOk split_def
                        getThreadCSpaceRoot_def locateSlot_conv
                        returnOk_liftE[symmetric] const_def
                        getSlotCap_def) apply (simp only: liftE_bindE_assoc) apply (rule monadic_rewrite_bind_alternative_l, wp) apply (rule monadic_rewrite_bind_tail) apply (rule monadic_rewrite_bind_alternative_l) apply (wp | simp)+ apply (rule_tac fn="case_sum Inl (Inr \<circ> fst)" in monadic_rewrite_split_fn) apply (simp add: liftME_liftM[symmetric] liftME_def bindE_assoc) apply (rule monadic_rewrite_refl) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (simp add: isRight_right_map isRight_case_sum) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (rule monadic_rewrite_bind_alternative_l[OF lookupIPC_inv]) apply monadic_rewrite_symb_exec_l apply (simp add: lookupExtraCaps_null returnOk_bind liftE_bindE_handle
                           bind_assoc liftE_bindE_assoc
                           decodeInvocation_def Let_def from_bool_0
                           performInvocation_def liftE_handle
                           liftE_bind) apply monadic_rewrite_symb_exec_r apply (rename_tac "send_ep") apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (simp add: getThreadVSpaceRoot_def locateSlot_conv) apply monadic_rewrite_symb_exec_r apply (rename_tac "pdCapCTE") apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply monadic_rewrite_symb_exec_r apply monadic_rewrite_symb_exec_r apply monadic_rewrite_symb_exec_r apply (simp add: isHighestPrio_def') apply monadic_rewrite_symb_exec_r apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply monadic_rewrite_symb_exec_r apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply monadic_rewrite_symb_exec_r apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (rule monadic_rewrite_trans,
                         rule monadic_rewrite_pick_alternative_1) apply monadic_rewrite_symb_exec_l 
                   (* now committed to fastpath *)
                    apply (rule monadic_rewrite_trans) apply (rule_tac F=True and E=True in monadic_rewrite_weaken_flags) apply simp apply (rule monadic_rewrite_bind_tail) apply (monadic_rewrite_symb_exec_l_known thread) apply (simp add: sendIPC_def bind_assoc) apply (monadic_rewrite_symb_exec_l_known send_ep) apply (rule_tac P="epQueue send_ep \<noteq> []" in monadic_rewrite_gen_asm) apply (simp add: isRecvEP_endpoint_case list_case_helper bind_assoc) apply (rule monadic_rewrite_bind_tail) apply (elim conjE) apply (rule monadic_rewrite_bind_tail, rename_tac dest_st) apply (rule_tac P="\<exists>gr. dest_st = BlockedOnReceive (capEPPtr (fst (theRight rv))) gr"
                                  in monadic_rewrite_gen_asm) apply monadic_rewrite_symb_exec_l_drop apply (rule monadic_rewrite_bind) apply clarsimp apply (rule_tac msgInfo=msgInfo in doIPCTransfer_simple_rewrite) apply (rule monadic_rewrite_bind_tail) apply (rule monadic_rewrite_bind) apply (rule_tac destPrio=destPrio
                                      and curDom=curDom and destDom=destDom and thread=thread
                                      in possibleSwitchTo_rewrite) apply (rule monadic_rewrite_bind) apply (rule monadic_rewrite_trans) apply (rule setupCallerCap_rewrite) apply (rule monadic_rewrite_bind_head) apply (rule setThreadState_rewrite_simple, simp) apply (rule monadic_rewrite_trans) apply (monadic_rewrite_symb_exec_l_known BlockedOnReply) apply simp apply (rule monadic_rewrite_refl) apply wpsimp apply (rule monadic_rewrite_trans) apply (rule monadic_rewrite_bind_head) apply (rule_tac t="hd (epQueue send_ep)"
                                       in schedule_rewrite_ct_not_runnable') apply (simp add: bind_assoc) apply (rule monadic_rewrite_bind_tail) apply (rule monadic_rewrite_bind) apply (rule switchToThread_rewrite) apply (rule monadic_rewrite_bind) apply (rule activateThread_simple_rewrite) apply (rule monadic_rewrite_refl) apply wp apply (wp setCurThread_ct_in_state) apply (simp only: st_tcb_at'_def[symmetric]) apply (wp, clarsimp simp: cur_tcb'_def ct_in_state'_def) apply (simp add: getThreadCallerSlot_def getThreadReplySlot_def
                                             locateSlot_conv ct_in_state'_def cur_tcb'_def) apply ((wp assert_inv threadSet_pred_tcb_at_state
                                       cteInsert_obj_at'_not_queued
                                    | wps)+)[1] apply (wp fastpathBestSwitchCandidate_lift[where f="cteInsert c w w'" for c w w']) apply ((wp assert_inv threadSet_pred_tcb_at_state cteInsert_obj_at'_not_queued | wps)+)[1] apply ((wp assert_inv threadSet_pred_tcb_at_state cteInsert_obj_at'_not_queued | wps)+)[1] apply ((wp assert_inv threadSet_pred_tcb_at_state cteInsert_obj_at'_not_queued | wps)+)[1] apply ((wp assert_inv threadSet_pred_tcb_at_state cteInsert_obj_at'_not_queued | wps)+)[1] apply (wp fastpathBestSwitchCandidate_lift[where f="threadSet f t" for f t]) apply simp apply ((wp assert_inv threadSet_pred_tcb_at_state
                                       cteInsert_obj_at'_not_queued
                                    | wps)+)[1] apply (simp add: setSchedulerAction_def) apply wp[1] apply (simp cong: if_cong HOL.conj_cong add: if_bool_simps) apply (simp_all only:)[5] apply ((wp setThreadState_oa_queued[of _ "\<lambda>a _ _. \<not> a"]
                                     setThreadState_obj_at_unchanged
                                     asUser_obj_at_unchanged mapM_x_wp'
                                     sts_st_tcb_at'_cases
                                     setThreadState_no_sch_change
                                     setEndpoint_obj_at_tcb'
                                     fastpathBestSwitchCandidate_lift[where f="setThreadState f t" for f t]
                                     setThreadState_oa_queued
                                     fastpathBestSwitchCandidate_lift[where f="asUser t f" for f t]
                                     fastpathBestSwitchCandidate_lift[where f="setEndpoint a b" for a b]
                                     lookupBitmapPriority_lift
                                     setThreadState_runnable_bitmap_inv
                                     getEndpoint_obj_at'
                                   | simp add: setMessageInfo_def
                                   | wp (once) hoare_vcg_disj_lift)+) apply (simp add: setThreadState_runnable_simp
                                    getThreadCallerSlot_def getThreadReplySlot_def
                                    locateSlot_conv bind_assoc) apply (rule_tac P="\<lambda>v.  obj_at' (%tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep))"
                           in monadic_rewrite_exists_v) apply (rename_tac ipcBuffer) apply (rule_tac P="\<lambda>v.  obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep))"
                           in monadic_rewrite_exists_v) apply (rename_tac destState) apply (simp add: ARM_H.switchToThread_def bind_assoc) 
                  (* retrieving state or thread registers is not thread_action_isolatable,
                     translate into return with suitable precondition  *)
                    apply (rule monadic_rewrite_trans[OF _ monadic_rewrite_transverse]) apply (rule_tac v=destState in monadic_rewrite_getThreadState
                            | rule monadic_rewrite_bind monadic_rewrite_refl)+ apply (wp mapM_x_wp' getObject_inv | wpc | simp | wp (once) hoare_drop_imps)+ apply (rule_tac v=destState in monadic_rewrite_getThreadState
                           | rule monadic_rewrite_bind monadic_rewrite_refl)+ apply (wp mapM_x_wp' getObject_inv | wpc | simp | wp (once) hoare_drop_imps)+ apply (rule_tac P="inj (case_bool thread (hd (epQueue send_ep)))"
                            in monadic_rewrite_gen_asm) apply (rule monadic_rewrite_trans[OF _ monadic_rewrite_transverse]) apply (rule monadic_rewrite_weaken_flags[where F=False and E=True], simp) apply (rule isolate_thread_actions_rewrite_bind
                                 fastpath_isolate_rewrites fastpath_isolatables
                                 bool.simps setRegister_simple
                                 setVMRoot_isolatable[THEN thread_actions_isolatableD] setVMRoot_isolatable
                                 doMachineOp_isolatable[THEN thread_actions_isolatableD] doMachineOp_isolatable
                                 kernelExitAssertions_isolatable[THEN thread_actions_isolatableD]
                                 kernelExitAssertions_isolatable
                                 zipWithM_setRegister_simple
                                 thread_actions_isolatable_bind
                              | assumption
                              | wp assert_inv)+ apply (rule_tac P="\<lambda>s. ksSchedulerAction s = ResumeCurrentThread
                                       \<and> tcb_at' thread s"
                              and F=True and E=False in monadic_rewrite_weaken_flags) apply simp apply (rule monadic_rewrite_isolate_final) apply (simp add: isRight_case_sum cong: list.case_cong) apply (clarsimp simp: fun_eq_iff if_flip
                                   cong: if_cong) apply (drule obj_at_ko_at', clarsimp) apply (frule get_tcb_state_regs_ko_at') apply (clarsimp simp: zip_map2 zip_same_conv_map foldl_map
                                         foldl_fun_upd
                                         foldr_copy_register_tsrs
                                         isRight_case_sum
                                   cong: if_cong) apply (simp add: upto_enum_def fromEnum_def
                                    enum_register  toEnum_def
                                    msgRegisters_unfold
                               cong: if_cong) apply (clarsimp split: if_split) apply (rule ext) apply (simp add: badgeRegister_def msgInfoRegister_def
                                    ARM.badgeRegister_def
                                    ARM.msgInfoRegister_def
                             split: if_split) apply simp apply (wp | simp cong: if_cong bool.case_cong
                            | rule getCTE_wp' gts_wp' threadGet_wp
                                  getEndpoint_wp)+ apply (rule validE_cases_valid) apply (simp add: isRight_def getSlotCap_def) apply (wp getCTE_wp') apply (rule resolveAddressBits_points_somewhere) apply (simp cong: if_cong bool.case_cong) apply wp apply simp apply (wp user_getreg_wp threadGet_wp)+ apply clarsimp apply (subgoal_tac "ksCurThread s \<noteq> ksIdleThread s") prefer 2 apply (fastforce simp: ct_in_state'_def dest: ct_running_not_idle' elim: pred_tcb'_weakenE) apply (clarsimp simp: ct_in_state'_def pred_tcb_at') apply (frule cte_wp_at_valid_objs_valid_cap', clarsimp+) apply (clarsimp simp: isCap_simps valid_cap'_def maskCapRights_def) apply (frule ko_at_valid_ep', clarsimp) apply (frule sym_refs_ko_atD'[where 'a=endpoint], clarsimp) apply (clarsimp simp: valid_ep'_def isRecvEP_endpoint_case neq_Nil_conv
                        tcbVTableSlot_def cte_level_bits_def
                        cte_at_tcb_at_16' length_msgRegisters
                        size_msgRegisters_def order_less_imp_le
                        ep_q_refs_of'_def st_tcb_at_refs_of_rev'
                  cong: if_cong) apply (rename_tac blockedThread ys tcba tcbb) apply (frule invs_mdb') apply (thin_tac "Ball S P" for S P)+ supply imp_disjL[simp del] apply (subst imp_disjL[symmetric]) 

  (* clean up broken up disj implication and excessive references to same tcbs *)
   apply normalise_obj_at' apply (clarsimp simp: invs'_def valid_state'_def) apply (fold imp_disjL, intro allI impI) apply (subgoal_tac "ksCurThread s \<noteq> blockedThread") prefer 2 apply normalise_obj_at' apply clarsimp apply (frule_tac t="blockedThread" in valid_queues_not_runnable_not_queued, assumption) subgoal by (fastforce simp: st_tcb_at'_def elim: obj_at'_weakenE) apply (subgoal_tac "fastpathBestSwitchCandidate blockedThread s") prefer 2 apply (rule_tac ttcb=tcbb and ctcb=tcb in fastpathBestSwitchCandidateI) apply (solves \<open>simp only: disj_ac\<close>) apply simp+ apply (clarsimp simp: st_tcb_at'_def obj_at'_def objBits_simps projectKOs valid_mdb'_def
                        valid_mdb_ctes_def inj_case_bool
                 split: bool.split)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) (callKernel (SyscallEvent SysCall)) (fastpaths SysCall) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) (callKernel (SyscallEvent SysCall)) (fastpaths SysCall) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) (callKernel (SyscallEvent SysCall)) (fastpaths SysCall) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) (callKernel (SyscallEvent SysCall)) (fastpaths SysCall) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) (callKernel (SyscallEvent SysCall)) (fastpaths SysCall) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) (callKernel (SyscallEvent SysCall)) (fastpaths SysCall) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) (do stateAssert fastpathKernelAssertions [];
runExceptT $ handleEvent (SyscallEvent SysCall) `~catchError~` (\<lambda>_. withoutPreemption $ do irq <- doMachineOp (getActiveIRQ True);
when (isJust irq) $ handleInterrupt (fromJust irq)
od);
ThreadDecls_H.schedule;
activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (fastpaths SysCall) proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?Q3 (do stateAssert fastpathKernelAssertions [];
runExceptT $ handleEvent (SyscallEvent SysCall) `~catchError~` (\<lambda>_. withoutPreemption $ do irq <- doMachineOp (getActiveIRQ True);
when (isJust irq) $ handleInterrupt (fromJust irq)
od);
ThreadDecls_H.schedule;
activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (fastpaths SysCall)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> ?Q3 s proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?Q3 (do x <- stateAssert fastpathKernelAssertions [];
K_bind (do runExceptT $ handleEvent (SyscallEvent SysCall) `~catchError~` (\<lambda>_. withoutPreemption $ do irq <- doMachineOp (getActiveIRQ True);
when (isJust irq) $ handleInterrupt (fromJust irq)
od);
ThreadDecls_H.schedule;
activateThread;
stateAssert kernelExitAssertions []
od) x \<sqinter> callKernel (SyscallEvent SysCall)
od) (fastpaths SysCall)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> ?Q3 s proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?P13 (K_bind (do runExceptT $ handleEvent (SyscallEvent SysCall) `~catchError~` (\<lambda>_. withoutPreemption $ do irq <- doMachineOp (getActiveIRQ True);
when (isJust irq) $ handleInterrupt (fromJust irq)
od);
ThreadDecls_H.schedule;
activateThread;
stateAssert kernelExitAssertions []
od) () \<sqinter> callKernel (SyscallEvent SysCall)) (fastpaths SysCall)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?P13 (do thread <- getCurThread;
x <- asUser thread (getRegister TCB_H.msgInfoRegister);
ptr <- asUser thread (getRegister Thread_H.capRegister);
y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord x);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord x));
global.decodeInvocation (msgLabel (messageInfoFromWord x)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (fastpaths SysCall)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?P13 (do thread <- getCurThread;
x <- asUser thread (getRegister TCB_H.msgInfoRegister);
ptr <- asUser thread (getRegister Thread_H.capRegister);
y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord x);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord x));
global.decodeInvocation (msgLabel (messageInfoFromWord x)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do curThread <- getCurThread;
x <- asUser curThread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser curThread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority curThread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) curThread;
replySlot <- getThreadReplySlot curThread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap curThread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall)
od)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?P13 (do thread <- getCurThread;
do x <- asUser thread (getRegister TCB_H.msgInfoRegister);
ptr <- asUser thread (getRegister Thread_H.capRegister);
y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord x);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord x));
global.decodeInvocation (msgLabel (messageInfoFromWord x)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)
od) (do curThread <- getCurThread;
x <- asUser curThread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser curThread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority curThread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) curThread;
replySlot <- getThreadReplySlot curThread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap curThread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall)
od)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (3 subgoals):
 1. \<And>thread. monadic_rewrite True False (?Q55 thread) (do x <- asUser thread (getRegister TCB_H.msgInfoRegister);
ptr <- asUser thread (getRegister Thread_H.capRegister);
y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord x);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord x));
global.decodeInvocation (msgLabel (messageInfoFromWord x)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do x <- asUser thread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser thread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall)
od)
 2. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 3. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (3 subgoals):
 1. \<And>thread. monadic_rewrite True False (?Q55 thread) (do x <- asUser thread (getRegister TCB_H.msgInfoRegister);
do ptr <- asUser thread (getRegister Thread_H.capRegister);
y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord x);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord x));
global.decodeInvocation (msgLabel (messageInfoFromWord x)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)
od) (do x <- asUser thread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser thread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall)
od)
 2. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 3. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (4 subgoals):
 1. \<And>thread x. monadic_rewrite True False (?Q65 thread x) (do ptr <- asUser thread (getRegister Thread_H.capRegister);
y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord x);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord x));
global.decodeInvocation (msgLabel (messageInfoFromWord x)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do cptr <- asUser thread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 3. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 4. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (4 subgoals):
 1. \<And>thread msgInfo. monadic_rewrite True False (?Q65 thread msgInfo) (do ptr <- asUser thread (getRegister Thread_H.capRegister);
y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do cptr <- asUser thread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 3. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 4. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (4 subgoals):
 1. \<And>thread msgInfo. monadic_rewrite True False (?Q65 thread msgInfo) (do ptr <- asUser thread (getRegister Thread_H.capRegister);
do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)
od) (do cptr <- asUser thread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 3. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 4. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (5 subgoals):
 1. \<And>thread msgInfo ptr. monadic_rewrite True False (?Q75 thread msgInfo ptr) (do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>?Q75 thread msgInfo\<rbrace>
 3. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 4. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 5. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr fault. monadic_rewrite True False (?Q79 thread msgInfo ptr fault) (do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) ((if fault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>?Q79 thread msgInfo ptr\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr tcbFault. monadic_rewrite True False (?Q79 thread msgInfo ptr tcbFault) (do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) ((if tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)) \<sqinter> callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>?Q79 thread msgInfo ptr\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo ptr tcbFault. monadic_rewrite True False (?Q108 thread msgInfo ptr tcbFault) (do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr tcbFault. monadic_rewrite True False (?P108 thread msgInfo ptr tcbFault) (do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 3. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. ?P108 thread msgInfo ptr tcbFault and ?Q108 thread msgInfo ptr tcbFault\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr tcbFault. monadic_rewrite True False (?P108 thread msgInfo ptr tcbFault) (do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. ?P108 thread msgInfo ptr tcbFault and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo ptr tcbFault. \<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<Longrightarrow> monadic_rewrite True False (?R112 thread msgInfo ptr tcbFault) (do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr tcbFault. tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q112 thread msgInfo ptr tcbFault) (do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 3. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> ?R112 thread msgInfo ptr tcbFault s)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr tcbFault. tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q112 thread msgInfo ptr tcbFault) (do y <- Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (slot, cap, extracaps, buffer)
odE) (handleFault thread) (\<lambda>(slot, cap, extracaps, buffer). doE args <- liftE (getMRs thread buffer (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr slot cap extracaps
odE) (\<lambda>err. replyFromKernel thread (msgFromSyscallError err)) (\<lambda>oper. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do ctab <- getThreadCSpaceRoot thread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do newVTable <- getThreadVSpaceRoot (hd (epQueue ep)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q112 thread msgInfo ptr None) (do x <- doE p <- rethrowFailure (Fault_H.fault.CapFault ptr False) (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (snd p, fst p, extracaps, buffer)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do x <- getThreadCSpaceRoot thread;
ctab <- getCTE x;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q112 thread msgInfo ptr None) (lookupCapAndSlot thread ptr >>= case_sum ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) (\<lambda>rv. do x <- doE buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, buffer)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)) (do x <- getThreadCSpaceRoot thread;
ctab <- getCTE x;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q112 thread msgInfo ptr None) (doE x <- liftE (getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot));
x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE >>= case_sum ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) (\<lambda>rv. do x <- doE buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, buffer)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)) (do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
cte <- liftE (getCTE (fst t));
returnOk (cteCap cte)
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q112 thread msgInfo ptr None) (do x <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE >>= case_sum ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) (\<lambda>rv. do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od)
od \<sqinter> callKernel (SyscallEvent SysCall)) (do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
cte <- liftE (getCTE (fst t));
returnOk (cteCap cte)
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q112 thread msgInfo ptr None) (do x <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
do a <- doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE;
case a of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od
od \<sqinter> callKernel (SyscallEvent SysCall)
od) (do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) ptr (size ptr);
cte <- liftE (getCTE (fst t));
returnOk (cteCap cte)
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q138 thread msgInfo ptr x) (do a <- doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE;
case a of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od
od \<sqinter> callKernel (SyscallEvent SysCall)) (do rv <- doE t <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
cte <- liftE (getCTE (fst t));
returnOk (cteCap cte)
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>?Q138 thread msgInfo ptr\<rbrace>
 3. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo ptr x P. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>P\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>_. P\<rbrace>
 2. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q138 thread msgInfo ptr x) (do x <- doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE;
(case x of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)
od) (do rv <- doE t <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
cte <- liftE (getCTE (fst t));
returnOk (cteCap cte)
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 3. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>?Q138 thread msgInfo ptr\<rbrace>
 4. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q138 thread msgInfo ptr x) (do x <- doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE;
(case x of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)
od) (do rv <- doE t <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
cte <- liftE (getCTE (fst t));
returnOk (cteCap cte)
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanSend (theRight rv) then do ep <- getEndpoint (capEPPtr (theRight rv));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight rv) \<or> capEPCanGrantReply (theRight rv) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight rv)) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight rv), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>?Q138 thread msgInfo ptr\<rbrace>
 3. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?P170 thread msgInfo ptr x) (liftM (case_sum Inl (Inr \<circ> fst)) (doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE)) (doE t <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
cte <- liftE (getCTE (fst t));
returnOk (cteCap cte)
odE)
 2. \<And>thread msgInfo ptr x rv. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q170 thread msgInfo ptr x rv) ((case rv of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)) (if isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) then if isEndpointCap (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<and> capEPCanSend (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do ep <- getEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<or> capEPCanGrantReply (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall))
 3. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>?Q170 thread msgInfo ptr x\<rbrace>
 4. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. ?P170 thread msgInfo ptr x and ?R170 thread msgInfo ptr x\<rbrace>
 5. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?P170 thread msgInfo ptr x) (doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
x <- liftE (getCTE (fst x));
returnOk (cteCap x)
odE) (doE t <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
cte <- liftE (getCTE (fst t));
returnOk (cteCap cte)
odE)
 2. \<And>thread msgInfo ptr x rv. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q170 thread msgInfo ptr x rv) ((case rv of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)) (if isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) then if isEndpointCap (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<and> capEPCanSend (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do ep <- getEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<or> capEPCanGrantReply (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall))
 3. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>?Q170 thread msgInfo ptr x\<rbrace>
 4. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. ?P170 thread msgInfo ptr x and ?R170 thread msgInfo ptr x\<rbrace>
 5. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo ptr x rv. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q170 thread msgInfo ptr x rv) ((case rv of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)) (if isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) then if isEndpointCap (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<and> capEPCanSend (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do ep <- getEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<or> capEPCanGrantReply (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>?Q170 thread msgInfo ptr x\<rbrace>
 3. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 4. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R173 thread msgInfo ptr x rv) ((case rv of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q173 thread msgInfo ptr x rv) ((case rv of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)) (if isEndpointCap (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<and> capEPCanSend (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do ep <- getEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<or> capEPCanGrantReply (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 3. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> ?Q173 thread msgInfo ptr x rv s) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> ?R173 thread msgInfo ptr x rv s)\<rbrace>
 4. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 5. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q173 thread msgInfo ptr x rv) ((case rv of Inl a \<Rightarrow> ((\<lambda>x. do y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<circ> Inl \<circ> Fault_H.fault.CapFault ptr False) a | Inr rv \<Rightarrow> do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd rv, fst rv, extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> doE a <- withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE;
case a of Inl e \<Rightarrow> withoutPreemption $ replyFromKernel thread (msgFromSyscallError e) | Inr b \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
odE) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) \<sqinter> callKernel (SyscallEvent SysCall)) (if isEndpointCap (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<and> capEPCanSend (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do ep <- getEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) \<or> capEPCanGrantReply (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (theRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> ?Q173 thread msgInfo ptr x rv s) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 4. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q173 thread msgInfo ptr x rv) (do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd (theRight rv), fst (theRight rv), extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) then do ep <- getEndpoint (capEPPtr (fst (theRight rv)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> ?Q173 thread msgInfo ptr x rv s) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 4. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; \<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R196 thread msgInfo ptr x rv) (do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd (theRight rv), fst (theRight rv), extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q196 thread msgInfo ptr x rv) (do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd (theRight rv), fst (theRight rv), extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do ep <- getEndpoint (capEPPtr (fst (theRight rv)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 3. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> ?R196 thread msgInfo ptr x rv s)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 5. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q196 thread msgInfo ptr x rv) (do x <- lookupIPCBuffer False thread;
x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd (theRight rv), fst (theRight rv), extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do ep <- getEndpoint (capEPPtr (fst (theRight rv)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 4. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q196 thread msgInfo ptr x rv) (do x <- lookupIPCBuffer False thread;
do x <- doE extracaps <- lookupExtraCaps thread x (messageInfoFromWord msgInfo);
returnOk (snd (theRight rv), fst (theRight rv), extracaps, x)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)
od) (do ep <- getEndpoint (capEPPtr (fst (theRight rv)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 4. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q206 thread msgInfo ptr x rv xa) (do x <- doE extracaps <- lookupExtraCaps thread xa (messageInfoFromWord msgInfo);
returnOk (snd (theRight rv), fst (theRight rv), extracaps, xa)
odE;
y <- (case x of Inl f \<Rightarrow> withoutPreemption $ handleFault thread f | Inr a \<Rightarrow> (withoutPreemption $ runExceptT $ doE args <- liftE (getMRs thread (snd (snd (snd a))) (messageInfoFromWord msgInfo));
global.decodeInvocation (msgLabel (messageInfoFromWord msgInfo)) args ptr (fst a) (fst (snd a)) (fst (snd (snd a)))
odE) >>=E case_sum (\<lambda>e. withoutPreemption $ replyFromKernel thread (msgFromSyscallError e)) (\<lambda>b. doE y <- liftE (setThreadState Structures_H.thread_state.Restart thread);
reply <- global.performInvocation True True b;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- replyFromKernel thread (0, reply);
setThreadState Structures_H.thread_state.Running thread
od))
odE)) <handle> (\<lambda>_. liftE (do irq <- doMachineOp (getActiveIRQ True);
when (\<exists>y. irq = Some y) (handleInterrupt (the irq))
od));
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do ep <- getEndpoint (capEPPtr (fst (theRight rv)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>?Q206 thread msgInfo ptr x rv\<rbrace>
 3. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 5. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q206 thread msgInfo ptr x rv xa) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do ep <- getEndpoint (capEPPtr (fst (theRight rv)));
if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>?Q206 thread msgInfo ptr x rv\<rbrace>
 3. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 5. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo ptr x rv xa ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q233 thread msgInfo ptr x rv xa ep) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if isRecvEP ep then do x <- getThreadVSpaceRoot (hd (epQueue ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue ep));
y <- Arch.switchToThread (hd (epQueue ep));
y <- setCurThread (hd (epQueue ep));
y <- asUser (hd (epQueue ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>?Q233 thread msgInfo ptr x rv xa\<rbrace>
 3. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 4. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 6. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q233 thread msgInfo ptr x rv xa send_ep) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if isRecvEP send_ep then do x <- getThreadVSpaceRoot (hd (epQueue send_ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>?Q233 thread msgInfo ptr x rv xa\<rbrace>
 3. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 4. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 6. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); \<not> isRecvEP send_ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R262 thread msgInfo ptr x rv xa send_ep) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q262 thread msgInfo ptr x rv xa send_ep) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do x <- getThreadVSpaceRoot (hd (epQueue send_ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 3. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> ?Q262 thread msgInfo ptr x rv xa send_ep s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> ?R262 thread msgInfo ptr x rv xa send_ep s)\<rbrace>
 4. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 5. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 7. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q262 thread msgInfo ptr x rv xa send_ep) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do x <- getThreadVSpaceRoot (hd (epQueue send_ep));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> ?Q262 thread msgInfo ptr x rv xa send_ep s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 4. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 6. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q262 thread msgInfo ptr x rv xa send_ep) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do newVTable <- getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> ?Q262 thread msgInfo ptr x rv xa send_ep s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 4. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 6. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep newVTable. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q267 thread msgInfo ptr x rv xa send_ep newVTable) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>?Q267 thread msgInfo ptr x rv xa send_ep\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 5. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 7. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q267 thread msgInfo ptr x rv xa send_ep pdCapCTE) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if isValidVTableRoot (cteCap pdCapCTE) then do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>?Q267 thread msgInfo ptr x rv xa send_ep\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 5. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 7. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; \<not> isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R296 thread msgInfo ptr x rv xa send_ep pdCapCTE) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q296 thread msgInfo ptr x rv xa send_ep pdCapCTE) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 3. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> ?Q296 thread msgInfo ptr x rv xa send_ep pdCapCTE s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> ?R296 thread msgInfo ptr x rv xa send_ep pdCapCTE s)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 6. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 8. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 10. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q296 thread msgInfo ptr x rv xa send_ep pdCapCTE) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do curDom <- curDomain;
curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> ?Q296 thread msgInfo ptr x rv xa send_ep pdCapCTE s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 5. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 7. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q301 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do curPrio <- threadGet tcbPriority thread;
destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>?Q301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 6. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 8. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 10. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do destPrio <- threadGet tcbPriority (hd (epQueue send_ep));
highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>?Q330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 7. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 9. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 10. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do highest <- isHighestPrio curDom destPrio;
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>?Q360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 8. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 10. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do highest <- gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio);
if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>?Q360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 8. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 10. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if curPrio \<le> destPrio \<or> highest then if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall) else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>?Q390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 9. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); \<not> (curPrio \<le> destPrio \<or> highest)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R419 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q419 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> ?Q419 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest s) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> ?R419 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest s)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 10. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q419 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> ?Q419 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest s) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 9. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; \<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R423 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q423 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> ?Q423 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> ?R423 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest s)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 10. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q423 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> ?Q423 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 9. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v} then do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>?Q428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 10. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R457 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q457 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> ?Q457 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> ?R457 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap s)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q457 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do destDom <- threadGet tcbDomain (hd (epQueue send_ep));
if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall)
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> ?Q457 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
 10. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. (isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> ?Q196 thread msgInfo ptr x rv s) \<and> (\<not> (isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> True)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (if destDom = curDom then do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>?Q462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom \<noteq> curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R491 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (callKernel (SyscallEvent SysCall))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q491 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ?Q491 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom s) \<and> (destDom \<noteq> curDom \<longrightarrow> ?R491 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom s)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q491 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysCall)) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ?Q491 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) (do x <- getMRs thread xa (messageInfoFromWord msgInfo);
y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q500 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>?Q500 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q500 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>?Q500 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?g525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (?g525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite (True \<and> True) (True \<or> False) (?P525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?g525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (?g525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb) (do y <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?g525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (?g525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q529 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y) (do threada <- getCurThread;
y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) threada (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb y)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q529 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (setThreadState Structures_H.thread_state.Restart thread >>= ?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y) (do y <- sendIPC True True (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) thread (capEPPtr (fst (theRight rv)));
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb y)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and ?Q539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (setThreadState Structures_H.thread_state.Restart thread >>= ?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb ()) (do x <- getEndpoint (capEPPtr (fst (theRight rv)));
y <- case x of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint (capEPPtr (fst (theRight rv))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (True, capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if True then do setThreadState (Structures_H.thread_state.BlockedOnSend (capEPPtr (fst (theRight rv))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) True) thread;
setEndpoint (capEPPtr (fst (theRight rv))) $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if True then do setThreadState (Structures_H.thread_state.BlockedOnSend (capEPPtr (fst (theRight rv))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) True) thread;
setEndpoint (capEPPtr (fst (theRight rv))) $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ();
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ())
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and ?Q539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (setThreadState Structures_H.thread_state.Restart thread >>= ?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q565 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()) (do y <- case send_ep of Structures_H.endpoint.RecvEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint (capEPPtr (fst (theRight rv))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (True, capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if True then do setThreadState (Structures_H.thread_state.BlockedOnSend (capEPPtr (fst (theRight rv))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) True) thread;
setEndpoint (capEPPtr (fst (theRight rv))) $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if True then do setThreadState (Structures_H.thread_state.BlockedOnSend (capEPPtr (fst (theRight rv))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) True) thread;
setEndpoint (capEPPtr (fst (theRight rv))) $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ();
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ())
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ?Q565 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (setThreadState Structures_H.thread_state.Restart thread >>= ?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()) (do y <- case send_ep of Structures_H.endpoint.RecvEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint (capEPPtr (fst (theRight rv))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (True, capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if True then do setThreadState (Structures_H.thread_state.BlockedOnSend (capEPPtr (fst (theRight rv))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) True) thread;
setEndpoint (capEPPtr (fst (theRight rv))) $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if True then do setThreadState (Structures_H.thread_state.BlockedOnSend (capEPPtr (fst (theRight rv))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (capEPCanGrantReply (fst (theRight rv))) True) thread;
setEndpoint (capEPPtr (fst (theRight rv))) $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ();
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ())
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (setThreadState Structures_H.thread_state.Restart thread >>= ?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
recvState <- getThreadState (hd (epQueue send_ep));
y <- assert (isReceive recvState);
y <- doIPCTransfer thread (Some (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (hd (epQueue send_ep));
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant recvState);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ())
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (setThreadState Structures_H.thread_state.Restart thread >>= ?j534 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
A total of 22 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc) (do recvState <- getThreadState (hd (epQueue send_ep));
y <- assert (isReceive recvState);
y <- doIPCTransfer thread (Some (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (hd (epQueue send_ep));
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant recvState);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j598 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) >>= ?j598 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc) (do recvState <- getThreadState (hd (epQueue send_ep));
y <- assert (isReceive recvState);
y <- doIPCTransfer thread (Some (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (hd (epQueue send_ep));
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant recvState);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j598 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) >>= ?j598 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q604 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st) (do y <- assert (isReceive dest_st);
y <- doIPCTransfer thread (Some (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (hd (epQueue send_ep));
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j607 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>?Q604 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
xd <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
getThreadState (hd (epQueue send_ep)) >>= ?j607 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q611 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st) (do y <- assert (isReceive dest_st);
y <- doIPCTransfer thread (Some (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (hd (epQueue send_ep));
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j607 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ?Q611 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
xd <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
getThreadState (hd (epQueue send_ep)) >>= ?j607 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q611 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st) (do y <- doIPCTransfer thread (Some (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (hd (epQueue send_ep));
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j607 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ?Q611 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
xd <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
getThreadState (hd (epQueue send_ep)) >>= ?j607 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st) (doIPCTransfer thread (Some (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (hd (epQueue send_ep))) (?g642 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd) (do y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j640 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> ?g642 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and (?P637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
xd <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
xe <- getThreadState (hd (epQueue send_ep));
?g642 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd xe >>= ?j640 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd xe
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr)) (doIPCTransfer thread (Some (capEPPtr (fst (theRight rv)))) (capEPBadge (fst (theRight rv))) (capEPCanGrant (fst (theRight rv))) (hd (epQueue send_ep))) (?g642 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd) (do y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j640 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> ?g642 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and (?P637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
xd <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
xe <- getThreadState (hd (epQueue send_ep));
?g642 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd xe >>= ?j640 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd xe
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd) (do y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j640 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
xd <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
xe <- getThreadState (hd (epQueue send_ep));
do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od >>= ?j640 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd xe
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q662 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe) (do y <- possibleSwitchTo (hd (epQueue send_ep));
y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j665 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>?Q662 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
xd <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
xe <- getThreadState (hd (epQueue send_ep));
xf <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) >>= ?j665 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd xe xf
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
A total of 26 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe) (possibleSwitchTo (hd (epQueue send_ep))) (?g674 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf) (do y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j672 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> ?g674 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe \<lbrace>?Q669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. ?P669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf) (do y <- setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st);
x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j672 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>?Q669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do xc <- setThreadState Structures_H.thread_state.Restart thread;
xd <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
xe <- getThreadState (hd (epQueue send_ep));
xf <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xg <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) >>= ?j672 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc xd xe xf xg
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf) (setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st)) (?g686 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf xg. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf xg) (do x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf xg)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> ?g686 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf \<lbrace>?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. ?P681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf) (setupCallerCap thread (hd (epQueue send_ep)) (blockingIPCCanGrant dest_st)) (?g691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf) (?g691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf) (?g686 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf xg. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf xg) (do x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf xg)
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> ?g686 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf \<lbrace>?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. ?P691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf and ?Q691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf) (do setThreadState Structures_H.thread_state.BlockedOnReply thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od) (?g686 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf xg. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf xg) (do x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf xg)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> ?g686 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf \<lbrace>?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and ?Q691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf) (setThreadState Structures_H.thread_state.BlockedOnReply thread) (?g699 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf xg. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf xg) (do x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf xg)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do ?g699 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () xc dest_st xd xe xf;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and ?Q691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb () dest_st () () () ()) (do x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>?Q681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
A total of 28 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P711 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (do x <- getThreadState thread;
rv <- case x of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?g705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (?g705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. ?P711 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a and ?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q719 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (do rv <- case Structures_H.thread_state.BlockedOnReply of Structures_H.thread_state.Restart \<Rightarrow> do y <- replyFromKernel thread (0, []);
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ();
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?g705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?P721 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> getThreadState thread \<lbrace>\<lambda>rv' _. awaiting_reply' rv'\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (?g705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. ?P721 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a and ?Q719 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a and ?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
A total of 30 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q719 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (do y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?g705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb dest_st)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?P721 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> getThreadState thread \<lbrace>\<lambda>rv' _. awaiting_reply' rv'\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (?g705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. ?P721 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a and ?Q719 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a and ?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?P721 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> getThreadState thread \<lbrace>\<lambda>rv' _. awaiting_reply' rv'\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (do y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. ?P721 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a and (\<lambda>a. True) and ?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (do y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ?Q709 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
A total of 28 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P752 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (do y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?g746 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (?g746 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and (?P752 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P752 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) ThreadDecls_H.schedule (?g756 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (do a <- ?g756 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and (?P752 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (do a <- do setSchedulerAction ResumeCurrentThread;
global.switchToThread (hd (epQueue send_ep))
od;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()) (do y <- setSchedulerAction ResumeCurrentThread;
y <- global.switchToThread (hd (epQueue send_ep));
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j684 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () ())
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
A total of 28 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q759 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc) (do y <- global.switchToThread (hd (epQueue send_ep));
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j763 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () () xc)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>?Q759 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc) (global.switchToThread (hd (epQueue send_ep))) (?g772 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () () xc)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd) (do y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j770 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () () xc xd)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace> ?g772 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () () xc \<lbrace>?Q767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xc. ?P767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc and ?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
A total of 31 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd) (do y <- activateThread;
stateAssert kernelExitAssertions []
od) (?j770 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () () xc xd)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace> do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od \<lbrace>?Q767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xc. ct_in_state' (Not \<circ> runnable') and cur_tcb' and obj_at' (Not \<circ> tcbQueued) (hd (epQueue send_ep)) and ?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
A total of 30 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd) activateThread (?g785 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () () xc xd)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd xe) (stateAssert kernelExitAssertions []) (?j783 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () () xc xd xe)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd\<rbrace> ?g785 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () () xc xd \<lbrace>?Q780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace> do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od \<lbrace>\<lambda>xd. ?P780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd and ?R780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xc. ct_in_state' (Not \<circ> runnable') and cur_tcb' and obj_at' (Not \<circ> tcbQueued) (hd (epQueue send_ep)) and ?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
A total of 32 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd xe) (stateAssert kernelExitAssertions []) (?j783 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () () dest_st () () () () xc xd xe)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd\<rbrace> return () \<lbrace>?Q780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace> do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od \<lbrace>\<lambda>xd. ct_in_state' ((=) Structures_H.thread_state.Running) and ?R780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xc. ct_in_state' (Not \<circ> runnable') and cur_tcb' and obj_at' (Not \<circ> tcbQueued) (hd (epQueue send_ep)) and ?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
A total of 31 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd\<rbrace> return () \<lbrace>\<lambda>xe _. True\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace> do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od \<lbrace>\<lambda>xd. ct_in_state' ((=) Structures_H.thread_state.Running) and ?R780 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc xd\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xc. ct_in_state' (Not \<circ> runnable') and cur_tcb' and obj_at' (Not \<circ> tcbQueued) (hd (epQueue send_ep)) and ?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace> do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od \<lbrace>\<lambda>xd. ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>a. True)\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xc. ct_in_state' (Not \<circ> runnable') and cur_tcb' and obj_at' (Not \<circ> tcbQueued) (hd (epQueue send_ep)) and ?R767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st xc\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xc. ct_in_state' (Not \<circ> runnable') and cur_tcb' and obj_at' (Not \<circ> tcbQueued) (hd (epQueue send_ep)) and (\<lambda>s. obj_at' ((=) Structures_H.thread_state.Running \<circ> tcbState) (hd (epQueue send_ep)) s \<and> True)\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () dest_st () () () ()\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xc. ct_in_state' (Not \<circ> runnable') and cur_tcb' and obj_at' (Not \<circ> tcbQueued) (hd (epQueue send_ep)) and (\<lambda>s. st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) s \<and> True)\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace> do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant dest_st)) replySlot callerSlot
od \<lbrace>\<lambda>a. st_tcb_at' awaiting_reply' thread and (\<lambda>a. True) and ((\<lambda>a. ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> ct_in_state' (Not \<circ> runnable') a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a) and ?Q750 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () ()\<rbrace> do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
a <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False gr) replySlot callerSlot
od \<lbrace>\<lambda>a b. st_tcb_at' awaiting_reply' thread b \<and> ksSchedulerAction b = SwitchToThread (hd (epQueue send_ep)) \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread b) b \<and> ksCurThread b \<noteq> ksIdleThread b \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) b \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread b) b \<and> tcb_at' (ksCurThread b) b \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) (hd (epQueue send_ep)) b \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) b\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () ()\<rbrace> do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
a <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False gr) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot)
od \<lbrace>\<lambda>a b. st_tcb_at' awaiting_reply' thread b \<and> ksSchedulerAction b = SwitchToThread (hd (epQueue send_ep)) \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread b) b \<and> ksCurThread b \<noteq> ksIdleThread b \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) b \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread b) b \<and> tcb_at' (ksCurThread b) b \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) (hd (epQueue send_ep)) b \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) b\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R681 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe xf\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd xe prev_s. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P'834 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd xe prev_s\<rbrace> cteInsert (capability.ReplyCap thread False gr) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. fastpathBestSwitchCandidate (hd (epQueue send_ep)) s \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread prev_s) s \<and> tcb_at' (ksCurThread prev_s) s \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) (hd (epQueue send_ep)) s \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) s\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?B819 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd\<rbrace> assert (mdbNext (cteMDBNode xd) = 0 \<and> isReplyCap (cteCap xd) \<and> capReplyMaster (cteCap xd) \<and> mdbFirstBadged (cteMDBNode xd) \<and> mdbRevocable (cteMDBNode xd)) \<lbrace>\<lambda>xe s. st_tcb_at' awaiting_reply' thread s \<and> ksSchedulerAction s = SwitchToThread (hd (epQueue send_ep)) \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> ?P'834 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd xe s s\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?B816 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot) \<lbrace>?B819 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () ()\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread \<lbrace>?B816 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
A total of 30 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd xe prev_s. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P'858 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd xe prev_s\<rbrace> cteInsert (capability.ReplyCap thread False gr) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv s. obj_at' (\<lambda>a. \<not> tcbQueued a) (hd (epQueue send_ep)) s \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) s\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?B819 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd\<rbrace> assert (mdbNext (cteMDBNode xd) = 0 \<and> isReplyCap (cteCap xd) \<and> capReplyMaster (cteCap xd) \<and> mdbFirstBadged (cteMDBNode xd) \<and> mdbRevocable (cteMDBNode xd)) \<lbrace>\<lambda>xe s. st_tcb_at' awaiting_reply' thread s \<and> ksSchedulerAction s = SwitchToThread (hd (epQueue send_ep)) \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) s \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread s) s \<and> tcb_at' (ksCurThread s) s \<and> ?P'858 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd xe s s\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?B816 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot) \<lbrace>?B819 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () ()\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread \<lbrace>?B816 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?B819 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc xd\<rbrace> assert (mdbNext (cteMDBNode xd) = 0 \<and> isReplyCap (cteCap xd) \<and> capReplyMaster (cteCap xd) \<and> mdbFirstBadged (cteMDBNode xd) \<and> mdbRevocable (cteMDBNode xd)) \<lbrace>\<lambda>xe s. st_tcb_at' awaiting_reply' thread s \<and> ksSchedulerAction s = SwitchToThread (hd (epQueue send_ep)) \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) s \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread s) s \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) s \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) s\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?B816 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot) \<lbrace>?B819 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () ()\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread \<lbrace>?B816 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?B816 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr xc\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot) \<lbrace>\<lambda>xd s. st_tcb_at' awaiting_reply' thread s \<and> ksSchedulerAction s = SwitchToThread (hd (epQueue send_ep)) \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) s \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread s) s \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) s \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) s\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () ()\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread \<lbrace>?B816 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () ()\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread \<lbrace>\<lambda>xc s. st_tcb_at' awaiting_reply' thread s \<and> ksSchedulerAction s = SwitchToThread (hd (epQueue send_ep)) \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) s \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread s) s \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) s \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) s\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and ?R818 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr prev_s. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P'913 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr prev_s\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread \<lbrace>\<lambda>rv s. fastpathBestSwitchCandidate (hd (epQueue send_ep)) s \<and> st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread prev_s) s \<and> tcb_at' (ksCurThread prev_s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) s \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) s\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and (\<lambda>a. (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. awaiting_reply' (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb)))) thread a else st_tcb_at' awaiting_reply' thread a)) \<and> ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> (tcb_at' thread a \<longrightarrow> (if ksCurThread a = thread then obj_at' (\<lambda>tcb. \<not> runnable' (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb)))) thread a else st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread a) a)) \<and> ksCurThread a \<noteq> ksIdleThread a \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then True else True) (hd (epQueue send_ep)) a \<and> ?P'911 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals...
flex-flex pairs:
\<lambda>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr s. ?P'913 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr s s \<equiv>\<^sup>? \<lambda>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr. ?P'911 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () () proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr prev_s P t s. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; obj_at' (\<lambda>tcb. P (tcbPriority tcb)) t s\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>obj. if thread = t then P (tcbPriority (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) obj)) else P (tcbPriority obj)) t s
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr prev_s. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P'923 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr prev_s\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread \<lbrace>\<lambda>rv s. st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread prev_s) s \<and> tcb_at' (ksCurThread prev_s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) s \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) s\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and (\<lambda>a. (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. awaiting_reply' (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb)))) thread a else st_tcb_at' awaiting_reply' thread a)) \<and> ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> (tcb_at' thread a \<longrightarrow> (if ksCurThread a = thread then obj_at' (\<lambda>tcb. \<not> runnable' (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb)))) thread a else st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread a) a)) \<and> ksCurThread a \<noteq> ksIdleThread a \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then True else True) (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> ?P'921 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
A total of 28 subgoals...
flex-flex pairs:
\<lambda>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr s. ?P'923 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr s s \<equiv>\<^sup>? \<lambda>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr. ?P'921 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () () proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb v gr prev_s. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P'923 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr prev_s\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread \<lbrace>\<lambda>rv s. st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread prev_s) s \<and> tcb_at' (ksCurThread prev_s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) s \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) s\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and (\<lambda>a. (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. awaiting_reply' (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb)))) thread a else st_tcb_at' awaiting_reply' thread a)) \<and> ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> (tcb_at' thread a \<longrightarrow> (if ksCurThread a = thread then obj_at' (\<lambda>tcb. \<not> runnable' (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb)))) thread a else st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread a) a)) \<and> ksCurThread a \<noteq> ksIdleThread a \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then True else True) (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> ?P'921 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb xc dest_st xd xe xf a)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals...
flex-flex pairs:
\<lambda>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr s. ?P'923 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr s s \<equiv>\<^sup>? \<lambda>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap xb gr. ?P'921 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb () (Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) () () () proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xf. (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. (runnable' Structures_H.thread_state.BlockedOnReply \<or> ksSchedulerAction s \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread s) \<and> tcb_at' thread s) and (\<lambda>a. (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. awaiting_reply' (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb)))) thread a else st_tcb_at' awaiting_reply' thread a)) \<and> ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> (tcb_at' thread a \<longrightarrow> (if ksCurThread a = thread then obj_at' (\<lambda>tcb. \<not> runnable' (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb)))) thread a else st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread a) a)) \<and> ksCurThread a \<noteq> ksIdleThread a \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then True else True) (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> (tcb_at' thread a \<longrightarrow> (if ksCurThread a = thread then obj_at' (\<lambda>tcb. \<not> runnable' (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb)))) thread a else st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread a) a)) \<and> obj_at' (\<lambda>obj. if thread = ksCurThread a then True else True) (ksCurThread a) a \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then \<not> tcbQueued (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) obj) else \<not> tcbQueued obj) (hd (epQueue send_ep)) a \<and> (tcb_at' thread a \<longrightarrow> (if hd (epQueue send_ep) = thread then obj_at' (\<lambda>tcb. Structures_H.thread_state.Running = itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) tcb))) thread a else st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) a)))\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb () dest_st () ()\<rbrace> modify (ksSchedulerAction_update (\<lambda>_. SwitchToThread (hd (epQueue send_ep)))) \<lbrace>\<lambda>xf a. reply_masters_rvk_fb (ctes_of a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a \<and> ksSchedulerAction a = SwitchToThread (hd (epQueue send_ep)) \<and> (tcb_at' thread a \<longrightarrow> (if ksCurThread a = thread then True else st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread a) a)) \<and> ksCurThread a \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a \<and> (tcb_at' thread a \<longrightarrow> (if ksCurThread a = thread then True else st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread a) a)) \<and> tcb_at' (ksCurThread a) a \<and> obj_at' (\<lambda>obj. \<not> tcbQueued obj) (hd (epQueue send_ep)) a \<and> (tcb_at' thread a \<longrightarrow> (if hd (epQueue send_ep) = thread then False else st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) a))\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and ?R669 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd xe\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st xd\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe. (\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = destDom) (hd (epQueue send_ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> ksCurDomain s = curDom \<and> destDom = curDom) and (\<lambda>a. reply_masters_rvk_fb (ctes_of (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>)) \<and> (ksSchedulerAction (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>)) \<and> tcb_at' thread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<and> ksSchedulerAction (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) = SwitchToThread (hd (epQueue send_ep)) \<and> (tcb_at' thread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<longrightarrow> (if ksCurThread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) = thread then True else st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>)) (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>))) \<and> ksCurThread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<noteq> ksIdleThread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<and> tcb_at' (hd (epQueue send_ep)) (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<and> (tcb_at' thread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<longrightarrow> (if ksCurThread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) = thread then True else st_tcb_at' (\<lambda>a. \<not> runnable' a) (ksCurThread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>)) (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>))) \<and> tcb_at' (ksCurThread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>)) (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<and> obj_at' (\<lambda>obj. \<not> tcbQueued obj) (hd (epQueue send_ep)) (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<and> (tcb_at' thread (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>) \<longrightarrow> (if hd (epQueue send_ep) = thread then False else st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) (a\<lparr>ksSchedulerAction := SwitchToThread (hd (epQueue send_ep))\<rparr>))))\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb () dest_st ()\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe a. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = curDom) (hd (epQueue send_ep)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = curDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a \<and> obj_at' (\<lambda>obj. \<not> tcbQueued obj) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) a\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb () dest_st ()\<rbrace> setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep)) \<lbrace>\<lambda>xe a. obj_at' (\<lambda>tcb. tcbPriority tcb = destPrio \<and> tcbDomain tcb = curDom) (hd (epQueue send_ep)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = curDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> fastpathBestSwitchCandidate (hd (epQueue send_ep)) a \<and> obj_at' (\<lambda>obj. \<not> tcbQueued obj) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (hd (epQueue send_ep)) a\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc dest_st. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr\<rbrakk> \<Longrightarrow> \<lbrace>?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb xc dest_st\<rbrace> do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od \<lbrace>?Q637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb xc dest_st\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb xc. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb xc\<rbrace> getThreadState (hd (epQueue send_ep)) \<lbrace>\<lambda>dest_st. (\<lambda>_. \<exists>gr. dest_st = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) and ((\<lambda>_. 0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) and obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msgInfo) thread and ?R637 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb xc dest_st)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; epQueue send_ep \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep))) \<lbrace>?Q594 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ()\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>rv' _. rv' = send_ep\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>y. ?P539 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb y and (?P567 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y and ((\<lambda>_. epQueue send_ep \<noteq> []) and ?Q592 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb y))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (hd (epQueue send_ep)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
xa <- setSchedulerAction ResumeCurrentThread;
xa <- do Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. ?P533 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb) (do x <- setThreadState Structures_H.thread_state.Restart thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
xa <- do rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))))
od;
xa <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
a <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) replySlot callerSlot
od;
x <- setSchedulerAction ResumeCurrentThread;
x <- do a <- Arch.switchToThread (hd (epQueue send_ep));
setCurThread (hd (epQueue send_ep))
od;
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlot <- getThreadReplySlot thread;
callerSlot <- getThreadCallerSlot (hd (epQueue send_ep));
replySlotCTE <- getCTE replySlot;
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) replySlot callerSlot;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
xa <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
xa <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
xa <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xa <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- Arch.switchToThread (hd (epQueue send_ep));
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and ?Q525 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb v. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>a. ?Q1691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb a v) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
xa <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
xa <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
xa <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xa <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- Arch.switchToThread (hd (epQueue send_ep));
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ?Q1691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb a v))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>a. ?Q1691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb a ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
xa <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
xa <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
xa <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xa <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- Arch.switchToThread (hd (epQueue send_ep));
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ?Q1691 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb a v))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer v. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>a. ?Q1695 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer a v) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
xa <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
xa <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
xa <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xa <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- Arch.switchToThread (hd (epQueue send_ep));
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ?Q1695 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v a va)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>a. ?Q1695 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer a destState) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
xa <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
xa <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
xa <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xa <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- Arch.switchToThread (hd (epQueue send_ep));
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
y <- Arch.switchToThread (hd (epQueue send_ep));
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ?Q1695 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v a va)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>a. ?Q1695 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer a destState) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
xa <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
xa <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
xa <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xa <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
y <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
y <- setVMRoot (hd (epQueue send_ep));
y <- doMachineOp ARM.clearExMonitor;
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ?Q1695 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v a va)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>a. ?Q1695 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer a destState) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
xa <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
xa <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
xa <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xa <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
y <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
y <- setVMRoot (hd (epQueue send_ep));
y <- doMachineOp ARM.clearExMonitor;
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ?Q1695 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v a va)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1707 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- getThreadState (hd (epQueue send_ep));
rva <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
xa <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
xa <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
xa <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xa <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
y <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (?g1697 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q1703 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
y <- setVMRoot (hd (epQueue send_ep));
y <- doMachineOp ARM.clearExMonitor;
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b1698 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (?g1697 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState) (?b1698 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState)
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> (?P1707 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and (?P1705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and ?Q1703 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va)) a)))\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
A total of 20 subgoals... proof (prove)
goal (35 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn xo xp xq. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1797 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn xo xp xq\<rbrace> setCurThread (hd (epQueue send_ep)) \<lbrace>\<lambda>xr _. True\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn xo xp. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1792 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn xo xp\<rbrace> doMachineOp ARM.clearExMonitor \<lbrace>\<lambda>xq. (\<lambda>_. True) and ?R1797 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn xo xp xq\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn xo. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn xo\<rbrace> setVMRoot (hd (epQueue send_ep)) \<lbrace>\<lambda>xp. (\<lambda>_. True) and ?R1792 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn xo xp\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1782 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xo. (\<lambda>_. True) and ?R1787 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn xo\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1777 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm\<rbrace> cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant xe)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>xn. (\<lambda>_. True) and ?R1782 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm xn\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1772 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl\<rbrace> assert (mdbNext (cteMDBNode xl) = 0 \<and> isReplyCap (cteCap xl) \<and> capReplyMaster (cteCap xl) \<and> mdbFirstBadged (cteMDBNode xl) \<and> mdbRevocable (cteMDBNode xl)) \<lbrace>\<lambda>xm. (\<lambda>_. True) and ?R1777 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot) \<lbrace>\<lambda>xl. (\<lambda>_. True) and ?R1772 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1762 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread \<lbrace>\<lambda>xk. (\<lambda>_. True) and ?R1767 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1757 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi\<rbrace> setSchedulerAction (SwitchToThread (hd (epQueue send_ep))) \<lbrace>\<lambda>xj. (\<lambda>_. True) and ?R1762 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1752 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh\<rbrace> threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep)) \<lbrace>\<lambda>xi. (\<lambda>_. True) and ?R1757 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi\<rbrace>
A total of 35 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q1703 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do y <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
replySlotCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
y <- assert (mdbNext (cteMDBNode replySlotCTE) = 0 \<and> isReplyCap (cteCap replySlotCTE) \<and> capReplyMaster (cteCap replySlotCTE) \<and> mdbFirstBadged (cteMDBNode replySlotCTE) \<and> mdbRevocable (cteMDBNode replySlotCTE));
destState <- getThreadState (hd (epQueue send_ep));
y <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
y <- setVMRoot (hd (epQueue send_ep));
y <- doMachineOp ARM.clearExMonitor;
y <- setCurThread (hd (epQueue send_ep));
y <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b1698 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb ipcBuffer destState)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- return destState;
xa <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
xa <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
xa <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
xa <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
xa <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
xa <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
xa <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xa <- assert (mdbNext (cteMDBNode xa) = 0 \<and> isReplyCap (cteCap xa) \<and> capReplyMaster (cteCap xa) \<and> mdbFirstBadged (cteMDBNode xa) \<and> mdbRevocable (cteMDBNode xa));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant x)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (?b1698 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = va else tcbState obj = va) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and (?P1705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and ?Q1703 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va)) a)))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R2071 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm\<rbrace> asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]) \<lbrace>\<lambda>xn _. True\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R2058 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl\<rbrace> setCurThread (hd (epQueue send_ep)) \<lbrace>\<lambda>xm. (\<lambda>_. True) and ?R2071 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl xm\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R2045 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk\<rbrace> doMachineOp ARM.clearExMonitor \<lbrace>\<lambda>xl. (\<lambda>_. True) and ?R2058 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk xl\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R2032 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj\<rbrace> setVMRoot (hd (epQueue send_ep)) \<lbrace>\<lambda>xk. (\<lambda>_. True) and ?R2045 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj xk\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R2019 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi\<rbrace> threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep)) \<lbrace>\<lambda>xj. (\<lambda>_. True) and ?R2032 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi xj\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R2002 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh\<rbrace> mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) \<lbrace>\<lambda>xi. (\<lambda>_. True) and ?R2019 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh xi\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1987 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg\<rbrace> cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant xg)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>xh. (\<lambda>_. True) and ?R2002 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg xh\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1972 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf\<rbrace> return destState \<lbrace>\<lambda>xg. (\<lambda>_. True) and ?R1987 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf xg\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1957 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe\<rbrace> assert (mdbNext (cteMDBNode xe) = 0 \<and> isReplyCap (cteCap xe) \<and> capReplyMaster (cteCap xe) \<and> mdbFirstBadged (cteMDBNode xe) \<and> mdbRevocable (cteMDBNode xe)) \<lbrace>\<lambda>xf. obj_at' (\<lambda>tcb. tcbState tcb = destState) (hd (epQueue send_ep)) and ?R1972 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe xf\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1942 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot) \<lbrace>\<lambda>xe. (\<lambda>_. True) and ?R1957 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState xc xd xe\<rbrace>
A total of 30 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
x <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
x <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
x <- assert (mdbNext (cteMDBNode x) = 0 \<and> isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x) \<and> mdbFirstBadged (cteMDBNode x) \<and> mdbRevocable (cteMDBNode x));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (do x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
x <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
x <- assert (mdbNext (cteMDBNode x) = 0 \<and> isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x) \<and> mdbFirstBadged (cteMDBNode x) \<and> mdbRevocable (cteMDBNode x));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
x <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
x <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = va else tcbState obj = va) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and (?P1705 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = va else tcbState a = va) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q2183 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
x <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
x <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
x <- assert (mdbNext (cteMDBNode x) = 0 \<and> isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x) \<and> mdbFirstBadged (cteMDBNode x) \<and> mdbRevocable (cteMDBNode x));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (do x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
x <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
x <- assert (mdbNext (cteMDBNode x) = 0 \<and> isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x) \<and> mdbFirstBadged (cteMDBNode x) \<and> mdbRevocable (cteMDBNode x));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
x <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
x <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = va else tcbState obj = va) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ?Q2183 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = va else tcbState a = va) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P2195 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
x <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
x <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
x <- assert (mdbNext (cteMDBNode x) = 0 \<and> isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x) \<and> mdbFirstBadged (cteMDBNode x) \<and> mdbRevocable (cteMDBNode x));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (?g2185 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q2191 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
x <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
x <- assert (mdbNext (cteMDBNode x) = 0 \<and> isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x) \<and> mdbFirstBadged (cteMDBNode x) \<and> mdbRevocable (cteMDBNode x));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
x <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
x <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b2186 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P2193 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (?g2185 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState) (?b2186 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState)
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = va else tcbState obj = va) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and (?P2195 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and (?P2193 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and ?Q2191 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va)) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = va else tcbState a = va) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?P2195 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart)) thread;
x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (hd (epQueue send_ep)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (hd (epQueue send_ep)) (setRegister Notification_H.badgeRegister (capEPBadge (fst (theRight rv))));
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
x <- setSchedulerAction (SwitchToThread (hd (epQueue send_ep)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
x <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
x <- assert (mdbNext (cteMDBNode x) = 0 \<and> isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x) \<and> mdbFirstBadged (cteMDBNode x) \<and> mdbRevocable (cteMDBNode x));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- setSchedulerAction ResumeCurrentThread;
x <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (?g2185 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap curDom xb ipcBuffer destState)
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q2191 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (do x <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply)) thread;
x <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
x <- assert (mdbNext (cteMDBNode x) = 0 \<and> isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x) \<and> mdbFirstBadged (cteMDBNode x) \<and> mdbRevocable (cteMDBNode x));
x <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (hd (epQueue send_ep)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (hd (epQueue send_ep));
x <- setVMRoot (hd (epQueue send_ep));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (hd (epQueue send_ep));
x <- asUser (hd (epQueue send_ep)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b2186 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState)
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P2193 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (?g2185 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState) (?b2186 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState)
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = va else tcbState obj = va) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and (?P2195 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and (?P2193 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and ?Q2191 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va)) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = va else tcbState a = va) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
A total of 20 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P2193 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curDom curPrio destPrio highest asidMap xb ipcBuffer destState) (isolate_thread_actions (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) (do a <- return ();
a <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
a <- return ();
a <- return ();
a <- return ();
a <- return ();
a <- return ();
a <- return ();
a <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
a <- assert (mdbNext (cteMDBNode a) = 0 \<and> isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a) \<and> mdbFirstBadged (cteMDBNode a) \<and> mdbRevocable (cteMDBNode a));
a <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
a <- return ();
a <- setVMRoot (hd (epQueue send_ep));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := capEPBadge (fst (theRight rv)))))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs Structures_H.thread_state.Restart (tsrContext (a True))))) (id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (hd (epQueue send_ep))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id)) (isolate_thread_actions (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) (do xc <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
xd <- return ();
xe <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xf <- assert (mdbNext (cteMDBNode xe) = 0 \<and> isReplyCap (cteCap xe) \<and> capReplyMaster (cteCap xe) \<and> mdbFirstBadged (cteMDBNode xe) \<and> mdbRevocable (cteMDBNode xe));
xg <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
xh <- return ();
xi <- return ();
xj <- setVMRoot (hd (epQueue send_ep));
xk <- doMachineOp ARM.clearExMonitor;
xl <- setCurThread (hd (epQueue send_ep));
xm <- return ();
stateAssert kernelExitAssertions []
od) (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (tsrs True)))) \<circ> id) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>va. obj_at' (\<lambda>tcb. tcbState tcb = va) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = va else tcbState obj = va) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and (?P2193 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom destDom curPrio destPrio highest asidMap xb v va and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = va else tcbState a = va) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom xb ipcBuffer destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite (True \<and> True) (False \<or> False) (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s) (isolate_thread_actions (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) (do a <- return ();
a <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
a <- return ();
a <- return ();
a <- return ();
a <- return ();
a <- return ();
a <- return ();
a <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
a <- assert (mdbNext (cteMDBNode a) = 0 \<and> isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a) \<and> mdbFirstBadged (cteMDBNode a) \<and> mdbRevocable (cteMDBNode a));
a <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
a <- return ();
a <- setVMRoot (hd (epQueue send_ep));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := capEPBadge (fst (theRight rv)))))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs Structures_H.thread_state.Restart (tsrContext (a True))))) (id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (hd (epQueue send_ep))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id)) (isolate_thread_actions (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) (do xc <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
xd <- return ();
xe <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xf <- assert (mdbNext (cteMDBNode xe) = 0 \<and> isReplyCap (cteCap xe) \<and> capReplyMaster (cteCap xe) \<and> mdbFirstBadged (cteMDBNode xe) \<and> mdbRevocable (cteMDBNode xe));
xg <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
xh <- return ();
xi <- return ();
xj <- setVMRoot (hd (epQueue send_ep));
xk <- doMachineOp ARM.clearExMonitor;
xl <- setCurThread (hd (epQueue send_ep));
xm <- return ();
stateAssert kernelExitAssertions []
od) (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [capEPBadge (fst (theRight rv)), wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (tsrs True)))) \<circ> id) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s) (isolate_thread_actions (case_bool thread (hd (epQueue send_ep))) (do a <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
a <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
a <- assert (mdbNext (cteMDBNode a) = 0 \<and> isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a) \<and> mdbFirstBadged (cteMDBNode a) \<and> mdbRevocable (cteMDBNode a));
a <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
a <- setVMRoot (hd (epQueue send_ep));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) (\<lambda>a aa. if aa then TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>aa. if aa then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (a True)) else a False) True)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>aa. if aa = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if aa = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>aa. if aa then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (a True)) else a False) False) aa)) (\<lambda>a. ResumeCurrentThread)) (isolate_thread_actions (case_bool thread (hd (epQueue send_ep))) (do xc <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
xe <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xf <- assert (mdbNext (cteMDBNode xe) = 0 \<and> isReplyCap (cteCap xe) \<and> capReplyMaster (cteCap xe) \<and> mdbFirstBadged (cteMDBNode xe) \<and> mdbRevocable (cteMDBNode xe));
xg <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
xj <- setVMRoot (hd (epQueue send_ep));
xk <- doMachineOp ARM.clearExMonitor;
xl <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od) ((\<lambda>a aa. if \<not> aa then TCBStateRegs (tsrState (a False)) (\<lambda>aa. if aa = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if aa = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else tsrContext (a False) aa) else a aa) \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (tsrs True))))) (\<lambda>a. a))
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep)))\<rbrakk> \<Longrightarrow> do a <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (drop (Suc 0) (epQueue send_ep)));
a <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
a <- assert (mdbNext (cteMDBNode a) = 0 \<and> isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a) \<and> mdbFirstBadged (cteMDBNode a) \<and> mdbRevocable (cteMDBNode a));
a <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
a <- setVMRoot (hd (epQueue send_ep));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od = do xc <- setEndpoint (capEPPtr (fst (theRight rv))) (case drop (Suc 0) (epQueue send_ep) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP (tl (epQueue send_ep)));
xe <- getCTE (thread + 2 ^ cte_level_bits * tcbReplySlot);
xf <- assert (mdbNext (cteMDBNode xe) = 0 \<and> isReplyCap (cteCap xe) \<and> capReplyMaster (cteCap xe) \<and> mdbFirstBadged (cteMDBNode xe) \<and> mdbRevocable (cteMDBNode xe));
xg <- cteInsert (capability.ReplyCap thread False (blockingIPCCanGrant destState)) (thread + 2 ^ cte_level_bits * tcbReplySlot) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbCallerSlot);
xj <- setVMRoot (hd (epQueue send_ep));
xk <- doMachineOp ARM.clearExMonitor;
xl <- setCurThread (hd (epQueue send_ep));
stateAssert kernelExitAssertions []
od
 2. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s tsrs. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> case_bool thread (hd (epQueue send_ep))\<rbrakk> \<Longrightarrow> (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (tsrs True)) else tsrs False) True)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (tsrs True)) else tsrs False) False) a)) = ((\<lambda>a b. if \<not> b then TCBStateRegs (tsrState (a False)) (\<lambda>b. if b = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if b = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else tsrContext (a False) b) else a b) \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (tsrs True))))) tsrs
 3. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s tsrs. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> case_bool thread (hd (epQueue send_ep))\<rbrakk> \<Longrightarrow> (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (tsrs True)) else tsrs False) True)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (tsrs True)) else tsrs False) False) a)) = ((\<lambda>a b. if \<not> b then TCBStateRegs (tsrState (a False)) (\<lambda>b. if b = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if b = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else tsrContext (a False) b) else a b) \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (tsrs True))))) tsrs
 2. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curPrio destPrio highest asidMap s tsrs v x. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); inj (case_bool thread (hd (epQueue send_ep))); \<forall>x. tsrs x = get_tcb_state_regs (ksPSpace s (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); ksSchedulerAction s = ResumeCurrentThread; tcb_at' thread s\<rbrakk> \<Longrightarrow> (if x then TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) True)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) False) a)) = (if x then foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (get_tcb_state_regs (ksPSpace s thread))))) True else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (get_tcb_state_regs (ksPSpace s thread))))) False) a))
 2. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curPrio destPrio highest asidMap s tsrs v x ko. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); inj (case_bool thread (hd (epQueue send_ep))); \<forall>x. tsrs x = get_tcb_state_regs (ksPSpace s (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s\<rbrakk> \<Longrightarrow> (if x then TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) True)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) False) a)) = (if x then foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (get_tcb_state_regs (ksPSpace s thread))))) True else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (get_tcb_state_regs (ksPSpace s thread))))) False) a))
 2. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curPrio destPrio highest asidMap s tsrs v x ko. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); inj (case_bool thread (hd (epQueue send_ep))); \<forall>x. tsrs x = get_tcb_state_regs (ksPSpace s (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) ((atcbContextGet \<circ> tcbArch) ko)\<rbrakk> \<Longrightarrow> (if x then TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) True)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. if a then TCBStateRegs Structures_H.thread_state.Restart (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) False) a)) = (if x then foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (get_tcb_state_regs (ksPSpace s thread))))) True else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (tsrs(True := TCBStateRegs Structures_H.thread_state.BlockedOnReply (tsrContext (get_tcb_state_regs (ksPSpace s thread))))) False) a))
 2. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curPrio destPrio highest asidMap s tsrs v x ko. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); inj (case_bool thread (hd (epQueue send_ep))); \<forall>x. tsrs x = get_tcb_state_regs (ksPSpace s (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) (atcbContextGet (tcbArch ko))\<rbrakk> \<Longrightarrow> (if x then TCBStateRegs Structures_H.thread_state.BlockedOnReply (atcbContextGet (tcbArch ko)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) a)) = (if x then TCBStateRegs Structures_H.thread_state.BlockedOnReply (atcbContextGet (tcbArch ko)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) a))
 2. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curPrio destPrio highest asidMap s tsrs v x ko. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); inj (case_bool thread (hd (epQueue send_ep))); \<forall>x. tsrs x = get_tcb_state_regs (ksPSpace s (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) (atcbContextGet (tcbArch ko))\<rbrakk> \<Longrightarrow> (if x then TCBStateRegs Structures_H.thread_state.BlockedOnReply (atcbContextGet (tcbArch ko)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) a)) = (if x then TCBStateRegs Structures_H.thread_state.BlockedOnReply (atcbContextGet (tcbArch ko)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) a))
 2. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curPrio destPrio highest asidMap s tsrs v x ko. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); inj (case_bool thread (hd (epQueue send_ep))); \<forall>x. tsrs x = get_tcb_state_regs (ksPSpace s (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) (atcbContextGet (tcbArch ko)); \<not> x\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) a) = (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) a)
 2. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curPrio destPrio highest asidMap s tsrs v x ko xa. \<lbrakk>isRight rv; isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); inj (case_bool thread (hd (epQueue send_ep))); \<forall>x. tsrs x = get_tcb_state_regs (ksPSpace s (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (fst (theRight rv)); capEPCanSend (fst (theRight rv)); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) (atcbContextGet (tcbArch ko)); \<not> x\<rbrakk> \<Longrightarrow> (if xa = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if xa = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if xa \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) xa else tsrContext (get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) xa) = (if xa = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if xa = Notification_H.badgeRegister then capEPBadge (fst (theRight rv)) else if xa \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) xa else tsrContext (get_tcb_state_regs (ksPSpace s (hd (epQueue send_ep)))) xa)
 2. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo rv send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom destState s. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom; inj (case_bool thread (hd (epQueue send_ep))); ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s\<rbrakk> \<Longrightarrow> ResumeCurrentThread = ksSchedulerAction s
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}; destDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom\<rbrace> getMRs thread xa (messageInfoFromWord msgInfo) \<lbrace>\<lambda>xb. (\<lambda>a. ksCurThread a = thread \<and> ko_at' send_ep (capEPPtr (fst (theRight rv))) a \<and> epQueue send_ep \<noteq> [] \<and> ((thread = hd (epQueue send_ep) \<longrightarrow> (\<exists>gr. Structures_H.thread_state.Restart = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) \<and> tcb_at' (hd (epQueue send_ep)) a) \<and> (thread \<noteq> hd (epQueue send_ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue send_ep)) a)) \<and> (0 = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters)) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> (atcbContextGet \<circ> tcbArch) a TCB_H.msgInfoRegister = msgInfo) thread a \<and> obj_at' (\<lambda>a. tcbPriority a = destPrio \<and> tcbDomain a = destDom) (hd (epQueue send_ep)) a \<and> (ksSchedulerAction a = ResumeCurrentThread \<and> (runnable' Structures_H.thread_state.Restart \<or> thread \<noteq> ksCurThread a)) \<and> ksCurThread a = thread \<and> ksCurDomain a = destDom \<and> reply_masters_rvk_fb (ctes_of a) \<and> tcb_at' thread a \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (hd (epQueue send_ep)) a \<and> (tcb_at' (hd (epQueue send_ep)) and fastpathBestSwitchCandidate (hd (epQueue send_ep))) a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue send_ep)) a \<and> hd (epQueue send_ep) \<noteq> thread \<and> tcb_at' (hd (epQueue send_ep)) a) and (\<lambda>a. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue send_ep)) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> obj_at' (\<lambda>obj. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>x. Structures_H.thread_state.Restart) obj) = v else tcbState obj = v) (hd (epQueue send_ep)) a \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) and ((\<lambda>_. inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep))) and ((\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a) and ((\<lambda>a. ksSchedulerAction a = ResumeCurrentThread \<and> tcb_at' thread a) and (\<lambda>a. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue send_ep)) a))) and ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> True \<and> obj_at' (\<lambda>a. if thread = hd (epQueue send_ep) then tcbState (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReply) a) = v else tcbState a = v) (hd (epQueue send_ep)) a)))) a)))\<rbrace>
 2. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)); \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap\<rbrace> threadGet tcbDomain (hd (epQueue send_ep)) \<lbrace>\<lambda>destDom s. (destDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q495 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap destDom) s) \<and> (destDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE); curPrio \<le> destPrio \<or> highest; capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P462 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest asidMap and tcb_at' (hd (epQueue send_ep))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pdCapCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> destPrio) \<lbrace>\<lambda>highest s. (curPrio \<le> destPrio \<or> highest \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (?P428 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio highest and (\<lambda>_. True)) s) \<and> (\<not> (capEPCanGrant (fst (theRight rv)) \<or> capEPCanGrantReply (fst (theRight rv))) \<longrightarrow> True)) \<and> (\<not> (curPrio \<le> destPrio \<or> highest) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio\<rbrace> threadGet tcbPriority (hd (epQueue send_ep)) \<lbrace>\<lambda>destPrio. ?P390 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio destPrio and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE curDom. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom\<rbrace> threadGet tcbPriority thread \<lbrace>\<lambda>curPrio. ?P360 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom curPrio and tcb_at' (hd (epQueue send_ep))\<rbrace>
 7. \<And>thread msgInfo ptr x rv xa send_ep pdCapCTE. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep; isValidVTableRoot (cteCap pdCapCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P330 thread msgInfo ptr x rv xa send_ep pdCapCTE curDom and tcb_at' thread\<rbrace>
 8. \<And>thread msgInfo ptr x rv xa send_ep. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)); isRecvEP send_ep\<rbrakk> \<Longrightarrow> \<lbrace>?P267 thread msgInfo ptr x rv xa send_ep\<rbrace> getCTE (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>pdCapCTE s. (isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> (?P301 thread msgInfo ptr x rv xa send_ep pdCapCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap pdCapCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo ptr x rv xa. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?P233 thread msgInfo ptr x rv xa\<rbrace> getEndpoint (capEPPtr (fst (theRight rv))) \<lbrace>\<lambda>send_ep s. (isRecvEP send_ep \<longrightarrow> (?P267 thread msgInfo ptr x rv xa send_ep and cte_wp_at' (\<lambda>_. True) (hd (epQueue send_ep) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (\<not> isRecvEP send_ep \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo ptr x rv. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rv; isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv))\<rbrakk> \<Longrightarrow> \<lbrace>?Q196 thread msgInfo ptr x rv\<rbrace> lookupIPCBuffer False thread \<lbrace>\<lambda>xa. ?P233 thread msgInfo ptr x rv xa and ep_at' (capEPPtr (fst (theRight rv)))\<rbrace>
A total of 17 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. isRight (case rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> isEndpointCap (fst (theRight rv)) \<and> capEPCanSend (fst (theRight rv)) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (fst (theRight rv))) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (theRight rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (theRight rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' thread s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (fst (theRight rv))) s\<rbrace>
 2. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 3. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. isRight (case Inr rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> isEndpointCap (fst (theRight (Inr rv))) \<and> capEPCanSend (fst (theRight (Inr rv))) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (fst (theRight (Inr rv)))) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (theRight (Inr rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inr rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (theRight (Inr rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inr rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (fst (theRight (Inr rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inr rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (theRight (Inr rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inr rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (theRight (Inr rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inr rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (theRight (Inr rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inr rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' thread s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (fst (theRight (Inr rv)))) s\<rbrace>, \<lbrace>\<lambda>rv s. isRight (case Inl rv of Inl x \<Rightarrow> Inl x | Inr x \<Rightarrow> (Inr \<circ> fst) x) \<longrightarrow> isEndpointCap (fst (theRight (Inl rv))) \<and> capEPCanSend (fst (theRight (Inl rv))) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (fst (theRight (Inl rv)))) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (theRight (Inl rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inl rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (theRight (Inl rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inl rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (fst (theRight (Inl rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inl rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (theRight (Inl rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inl rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (theRight (Inl rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inl rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (theRight (Inl rv))) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (theRight (Inl rv)))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' thread s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (fst (theRight (Inl rv)))) s\<rbrace>
 2. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 3. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?R170 thread msgInfo ptr x\<rbrace> doE x <- CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr);
xa <- liftE (getCTE (fst x));
returnOk (cteCap xa, fst x)
odE \<lbrace>\<lambda>rv s. isEndpointCap (fst rv) \<and> capEPCanSend (fst rv) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (fst rv)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst rv) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst rv)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst rv) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst rv)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (fst rv) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst rv)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst rv) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst rv)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst rv) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst rv)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst rv) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst rv)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' thread s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (fst rv)) s\<rbrace>, \<lbrace>\<lambda>rv s. True\<rbrace>
 2. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R170 thread msgInfo ptr x\<rbrace>
 3. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo ptr x. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P'4611 thread msgInfo ptr x\<rbrace> CSpace_H.resolveAddressBits (cteCap x) ptr (size ptr) \<lbrace>\<lambda>rv s. \<forall>cte. cte_wp_at' ((=) cte) (fst rv) s \<longrightarrow> isEndpointCap (fst (cteCap cte, fst rv)) \<and> capEPCanSend (fst (cteCap cte, fst rv)) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (fst (cteCap cte, fst rv))) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (cteCap cte, fst rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (cteCap cte, fst rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (fst (cteCap cte, fst rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (cteCap cte, fst rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (cteCap cte, fst rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (cteCap cte, fst rv)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst rv))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' thread s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (fst (cteCap cte, fst rv))) s\<rbrace>, -
 2. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> ?P'4611 thread msgInfo ptr x s)\<rbrace>
 3. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> (\<forall>slot cte. cte_wp_at' ((=) cte) (fst slot) s \<longrightarrow> isEndpointCap (fst (cteCap cte, fst slot)) \<and> capEPCanSend (fst (cteCap cte, fst slot)) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (fst (cteCap cte, fst slot))) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (cteCap cte, fst slot)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst slot))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (cteCap cte, fst slot)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst slot))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (fst (cteCap cte, fst slot)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst slot))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (cteCap cte, fst slot)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst slot))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (fst (cteCap cte, fst slot)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst slot))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (fst (cteCap cte, fst slot)) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (fst (cteCap cte, fst slot))) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' thread s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (fst (cteCap cte, fst slot))) s))\<rbrace>
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo ptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?Q112 thread msgInfo ptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>x s. \<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<and> capEPCanSend (cteCap cte) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' thread s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (cteCap cte)) s\<rbrace>
 2. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q112 thread msgInfo ptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (5 subgoals):
 1. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFaulta. (\<lambda>s. (tcbFaulta = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<and> capEPCanSend (cteCap cte) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' thread s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (cteCap cte)) s)) \<and> (\<not> (tcbFaulta = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 2. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 3. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 4. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 5. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (5 subgoals):
 1. \<And>thread msgInfo ptr. \<lbrace>?P79 thread msgInfo ptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFaulta s. tcbFaulta = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<and> capEPCanSend (cteCap cte) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s = thread \<and> epQueue ep \<noteq> [] \<and> thread \<noteq> hd (epQueue ep) \<and> (thread \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = msgInfo) thread s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> ksCurThread s = thread \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' thread s \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> thread \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if thread = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool thread (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if thread = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' thread s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (cteCap cte)) s)\<rbrace>
 2. \<And>thread msgInfo. \<lbrace>?Q65 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>ptr. ?P79 thread msgInfo ptr and tcb_at' thread\<rbrace>
 3. \<And>thread. \<lbrace>?Q55 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q65 thread\<rbrace>
 4. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q55\<rbrace>
 5. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (1 subgoal):
 1. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. ksDomainTime s \<noteq> 0)) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rva. obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = rva) (ksCurThread s) s \<longrightarrow> ((\<lambda>sa. \<forall>tcb. ko_at' tcb (ksCurThread s) sa \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>a cte. cte_wp_at' ((=) cte) a sa \<longrightarrow> isEndpointCap (cteCap cte) \<and> capEPCanSend (cteCap cte) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) sa \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) sa \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) sa \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) sa \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa)) \<and> (ksReadyQueuesL1Bitmap sa (ksCurDomain sa) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa)) \<and> (lookupBitmapPriority (ksCurDomain sa) sa \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa) \<and> tcb_at' (ksCurThread s) sa) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) sa) \<and> ep_at' (capEPPtr (cteCap cte)) sa)) and tcb_at' (ksCurThread s)) s))) \<and> (\<not> True \<longrightarrow> (tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rva. obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = rva) (ksCurThread s) s \<longrightarrow> ((\<lambda>sa. \<forall>tcb. ko_at' tcb (ksCurThread s) sa \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>a cte. cte_wp_at' ((=) cte) a sa \<longrightarrow> isEndpointCap (cteCap cte) \<and> capEPCanSend (cteCap cte) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) sa \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) sa \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) sa \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) sa \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa)) \<and> (ksReadyQueuesL1Bitmap sa (ksCurDomain sa) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa)) \<and> (lookupBitmapPriority (ksCurDomain sa) sa \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState sa))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) sa \<longrightarrow> tcbDomain tcb = ksCurDomain sa \<longrightarrow> ksCurThread sa = ksCurThread s \<and> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) sa) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) sa \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain sa) (hd (epQueue ep)) sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> ksCurThread sa = ksCurThread s \<and> reply_masters_rvk_fb (ctes_of sa) \<and> tcb_at' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> tcb_at' (hd (epQueue ep)) sa \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) sa \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) sa \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) sa \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) sa) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) sa \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) sa \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> tcb_at' (ksCurThread s) sa \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) sa) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa))) \<and> tcb_at' (hd (epQueue ep)) sa) \<and> tcb_at' (ksCurThread s) sa) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) sa) \<and> ep_at' (capEPPtr (cteCap cte)) sa)) and tcb_at' (ksCurThread s)) s))) \<and> fastpathKernelAssertions s) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> ((\<exists>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rv) (ksCurThread s) s) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<and> capEPCanSend (cteCap cte) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (cteCap cte)) s)) \<and> tcb_at' (ksCurThread s) s)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> ((\<exists>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rv) (ksCurThread s) s) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<and> capEPCanSend (cteCap cte) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (cteCap cte)) s)) \<and> tcb_at' (ksCurThread s) s))
 2. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> ksIdleThread s
 2. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> ((\<exists>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rv) (ksCurThread s) s) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<and> capEPCanSend (cteCap cte) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (cteCap cte)) s)) \<and> tcb_at' (ksCurThread s) s)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> ((\<exists>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rv) (ksCurThread s) s) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<and> capEPCanSend (cteCap cte) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> tcb_at' (ksCurThread s) s) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (cteCap cte)) s)) \<and> tcb_at' (ksCurThread s) s)) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) a s; isEndpointCap (cteCap cte); capEPCanSend (cteCap cte)\<rbrakk> \<Longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (cteCap cte)) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) a s; isEndpointCap (cteCap cte); capEPCanSend (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> isRecvEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (capEPCanGrant (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (capEPCanGrantReply (cteCap cte) \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> ep_at' (capEPPtr (cteCap cte)) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep\<rbrakk> \<Longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep; valid_ep' ep s\<rbrakk> \<Longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep; valid_ep' ep s; state_refs_of' s v0 = refs_of' (injectKOS ep) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS ep). ko_wp_at' (\<lambda>ko. (v0, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (\<forall>tcba. ko_at' tcba (hd (epQueue ep)) s \<longrightarrow> (tcbPriority tcb \<le> tcbPriority tcba \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb (hd (epQueue ep)) s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> epQueue ep \<noteq> [] \<and> ksCurThread s \<noteq> hd (epQueue ep) \<and> (ksCurThread s \<noteq> hd (epQueue ep) \<longrightarrow> st_tcb_at' (\<lambda>a. \<exists>gr. a = Structures_H.thread_state.BlockedOnReceive v0 gr) (hd (epQueue ep)) s) \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcba \<and> tcbDomain a = ksCurDomain s) (hd (epQueue ep)) s \<and> reply_masters_rvk_fb (ctes_of s) \<and> tcb_at' (hd (epQueue ep)) s \<and> fastpathBestSwitchCandidate (hd (epQueue ep)) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (hd (epQueue ep)) s \<and> hd (epQueue ep) \<noteq> ksCurThread s \<and> tcb_at' (hd (epQueue ep)) s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (hd (epQueue ep)) s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) (hd (epQueue ep)) s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.Restart = v else tcbState obj = v) (hd (epQueue ep)) s \<and> inj (case_bool (ksCurThread s) (hd (epQueue ep))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = hd (epQueue ep) then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s))) \<and> tcb_at' (hd (epQueue ep)) s)) \<and> cte_wp_at' (\<lambda>_. True) (hd (epQueue ep) + 2 ^ cte_level_bits * tcbVTableSlot) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep ctea y ys tcba tcbb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep; epQueue ep = y # ys; state_refs_of' s v0 = insert (y, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (y + 0x10) s; isValidVTableRoot (cteCap ctea); ko_at' tcba (ksCurThread s) s; ko_at' tcbb y s; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) y s; \<forall>x\<in>set ys. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) x s; tcb_at' y s; \<forall>t\<in>set ys. tcb_at' t s; y \<notin> set ys; distinct ys\<rbrakk> \<Longrightarrow> (tcbPriority tcba \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb y s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> y \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) y s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate y s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) y s \<and> y \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = y then Structures_H.thread_state.Restart = v else tcbState obj = v) y s \<and> inj (case_bool (ksCurThread s) y) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = y then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) y s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb y s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> y \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) y s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate y s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) y s \<and> y \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = y then Structures_H.thread_state.Restart = v else tcbState obj = v) y s \<and> inj (case_bool (ksCurThread s) y) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = y then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) y s))))) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb y s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> y \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) y s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate y s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) y s \<and> y \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = y then Structures_H.thread_state.Restart = v else tcbState obj = v) y s \<and> inj (case_bool (ksCurThread s) y) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = y then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) y s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb y s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> y \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) y s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate y s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) y s \<and> y \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = y then Structures_H.thread_state.Restart = v else tcbState obj = v) y s \<and> inj (case_bool (ksCurThread s) y) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = y then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) y s))))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb y s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> y \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) y s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate y s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) y s \<and> y \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = y then Structures_H.thread_state.Restart = v else tcbState obj = v) y s \<and> inj (case_bool (ksCurThread s) y) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = y then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) y s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb y s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> y \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) y s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate y s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) y s \<and> y \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) y s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) y s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = y then Structures_H.thread_state.Restart = v else tcbState obj = v) y s \<and> inj (case_bool (ksCurThread s) y) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = y then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) y s))))) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcba tcbb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); ko_at' tcba (ksCurThread s) s; ko_at' tcbb blockedThread s; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) blockedThread s; \<forall>x\<in>set ys. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) x s; tcb_at' blockedThread s; \<forall>t\<in>set ys. tcb_at' t s; blockedThread \<notin> set ys; distinct ys\<rbrakk> \<Longrightarrow> (tcbPriority tcba \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcba tcbb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); ko_at' tcba (ksCurThread s) s; ko_at' tcbb blockedThread s; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) blockedThread s; \<forall>x\<in>set ys. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) x s; tcb_at' blockedThread s; \<forall>t\<in>set ys. tcb_at' t s; blockedThread \<notin> set ys; distinct ys; valid_mdb' s\<rbrakk> \<Longrightarrow> (tcbPriority tcba \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcba tcbb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); ko_at' tcba (ksCurThread s) s; ko_at' tcbb blockedThread s; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) blockedThread s; tcb_at' blockedThread s; blockedThread \<notin> set ys; distinct ys; valid_mdb' s\<rbrakk> \<Longrightarrow> (tcbPriority tcba \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcba tcbb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); ko_at' tcba (ksCurThread s) s; ko_at' tcbb blockedThread s; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) blockedThread s; tcb_at' blockedThread s; blockedThread \<notin> set ys; distinct ys; valid_mdb' s\<rbrakk> \<Longrightarrow> (tcbPriority tcba \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcba tcbb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); ko_at' tcba (ksCurThread s) s; ko_at' tcbb blockedThread s; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) blockedThread s; tcb_at' blockedThread s; blockedThread \<notin> set ys; distinct ys; valid_mdb' s\<rbrakk> \<Longrightarrow> (tcbPriority tcba \<le> tcbPriority tcbb \<longrightarrow> v4 \<or> v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcba tcbb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); ep_at' v0 s; ko_at' ep v0 s; isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); ko_at' tcba (ksCurThread s) s; ko_at' tcbb blockedThread s; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive v0 a) blockedThread s; tcb_at' blockedThread s; blockedThread \<notin> set ys; distinct ys; valid_mdb' s\<rbrakk> \<Longrightarrow> (tcbPriority tcba \<le> tcbPriority tcbb \<longrightarrow> v4 \<or> v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s)))) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb blockedThread s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> obj_at' (\<lambda>a. tcbFault a = None \<and> atcbContextGet (tcbArch a) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb \<and> tcbDomain a = ksCurDomain s) blockedThread s \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) blockedThread s \<and> blockedThread \<noteq> ksCurThread s \<and> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) blockedThread s) \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbState tcb = v) blockedThread s \<longrightarrow> obj_at' (\<lambda>obj. if ksCurThread s = blockedThread then Structures_H.thread_state.Restart = v else tcbState obj = v) blockedThread s \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> obj_at' (\<lambda>a. if ksCurThread s = blockedThread then Structures_H.thread_state.BlockedOnReply = v else tcbState a = v) blockedThread s))))) proof (prove)
goal (1 subgoal):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa. \<lbrakk>invs' s; Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s\<rbrakk> \<Longrightarrow> (tcbPriority tcb \<le> tcbPriority tcbb \<longrightarrow> v4 \<or> v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True)) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True)) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True))) proof (prove)
goal (1 subgoal):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s\<rbrakk> \<Longrightarrow> (tcbPriority tcb \<le> tcbPriority tcbb \<longrightarrow> v4 \<or> v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True)) \<and> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True)) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (v4 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True)) \<and> (v5 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> tcbDomain tcbb = ksCurDomain s \<longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True))) proof (prove)
goal (1 subgoal):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; tcbDomain tcbb = ksCurDomain s\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True) proof (prove)
goal (2 subgoals):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True)
 2. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; tcbDomain tcbb = ksCurDomain s\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> blockedThread proof (prove)
goal (2 subgoals):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; tcbDomain tcbb = ksCurDomain s\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> blockedThread
 2. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True) proof (prove)
goal (1 subgoal):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> blockedThread \<and> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> blockedThread \<noteq> ksCurThread s \<and> (if ksCurThread s = blockedThread then False else True) \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) \<and> (if ksCurThread s = blockedThread then False else True) proof (prove)
goal (1 subgoal):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}\<rbrakk> \<Longrightarrow> st_tcb_at' (Not \<circ> runnable') blockedThread s
 2. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb_; ksSchedulerAction s_ = ResumeCurrentThread; ksDomainTime s_ \<noteq> 0; fastpathKernelAssertions s_; ksCurThread s_ \<noteq> ksIdleThread s_; tcbFault tcb_ = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte_) a_ s_; v2_; cteCap cte_ = capability.EndpointCap v0_ v1_ True v3_ v4_ v5_; capAligned (capability.EndpointCap v0_ v1_ True v3_ v4_ v5_); isRecvEP ep_; epQueue ep_ = blockedThread_ # ys_; state_refs_of' s_ v0_ = insert (blockedThread_, EPRecv) (set ys_ \<times> {EPRecv}); cte_wp_at' ((=) ctea_) (blockedThread_ + 0x10) s_; isValidVTableRoot (cteCap ctea_); blockedThread_ \<notin> set ys_; distinct ys_; valid_mdb' s_; tcbState tcbb_ = Structures_H.thread_state.BlockedOnReceive v0_ aa_; ko_at' ep_ v0_ s_; ko_at' tcbb_ blockedThread_ s_; ko_at' tcb_ (ksCurThread s_) s_; valid_pspace' s_; ct_in_state' activatable' s_; Invariants_H.valid_queues s_; sym_refs (state_refs_of' s_); if_live_then_nonz_cap' s_; if_unsafe_then_cap' s_; valid_idle' s_; valid_global_refs' s_; valid_arch_state' s_; valid_irq_node' (irq_node' s_) s_; valid_irq_handlers' s_; valid_irq_states' s_; valid_machine_state' s_; irqs_masked' s_; valid_queues' s_; ct_not_inQ s_; ct_idle_or_in_cur_domain' s_; valid_pde_mappings' s_; pspace_domain_valid s_; ksCurDomain s_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s_; cur_tcb' s_; tcbPriority tcb_ \<le> tcbPriority tcbb_ \<or> ksReadyQueuesL1Bitmap s_ (ksCurDomain s_) = 0 \<or> lookupBitmapPriority (ksCurDomain s_) s_ \<le> tcbPriority tcbb_; v4_ \<or> v5_; tcbDomain tcbb_ = ksCurDomain s_; ksCurThread s_ \<noteq> blockedThread_; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea_))) \<in> ran (armKSASIDMap (ksArchState s_))} = {v_}\<rbrakk> \<Longrightarrow> st_tcb_at' (Not \<circ> runnable') blockedThread_ s_ proof (prove)
goal (1 subgoal):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s; fastpathBestSwitchCandidate blockedThread s\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s)
 2. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s\<rbrakk> \<Longrightarrow> fastpathBestSwitchCandidate blockedThread s proof (prove)
goal (2 subgoals):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s\<rbrakk> \<Longrightarrow> fastpathBestSwitchCandidate blockedThread s
 2. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s; fastpathBestSwitchCandidate blockedThread s\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) proof (prove)
goal (4 subgoals):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s\<rbrakk> \<Longrightarrow> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> tcbPriority tcb \<le> tcbPriority tcbb \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb
 2. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s\<rbrakk> \<Longrightarrow> ko_at' tcbb blockedThread s
 3. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s\<rbrakk> \<Longrightarrow> ko_at' tcb (ksCurThread s) s
 4. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s; fastpathBestSwitchCandidate blockedThread s\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s\<rbrakk> \<Longrightarrow> ko_at' tcbb blockedThread s
 2. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s\<rbrakk> \<Longrightarrow> ko_at' tcb (ksCurThread s) s
 3. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s; fastpathBestSwitchCandidate blockedThread s\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (ctes_of s) \<and> fastpathBestSwitchCandidate blockedThread s \<and> \<not> tcbQueued tcbb \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) proof (prove)
goal (1 subgoal):
 1. \<And>s tcb a cte v0 v1 v2 v3 v4 v5 ep ctea blockedThread ys tcbb aa v. \<lbrakk>Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; ksDomainTime s \<noteq> 0; fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; cte_wp_at' ((=) cte) a s; v2; cteCap cte = capability.EndpointCap v0 v1 True v3 v4 v5; capAligned (capability.EndpointCap v0 v1 True v3 v4 v5); isRecvEP ep; epQueue ep = blockedThread # ys; state_refs_of' s v0 = insert (blockedThread, EPRecv) (set ys \<times> {EPRecv}); cte_wp_at' ((=) ctea) (blockedThread + 0x10) s; isValidVTableRoot (cteCap ctea); blockedThread \<notin> set ys; distinct ys; valid_mdb' s; tcbState tcbb = Structures_H.thread_state.BlockedOnReceive v0 aa; ko_at' ep v0 s; ko_at' tcbb blockedThread s; ko_at' tcb (ksCurThread s) s; valid_pspace' s; ct_in_state' activatable' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; tcbPriority tcb \<le> tcbPriority tcbb \<or> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; v4 \<or> v5; tcbDomain tcbb = ksCurDomain s; ksCurThread s \<noteq> blockedThread; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; obj_at' (Not \<circ> tcbQueued) blockedThread s; fastpathBestSwitchCandidate blockedThread s\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (ctes_of s) \<and> \<not> tcbQueued tcbb \<and> inj (case_bool (ksCurThread s) blockedThread) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> hd (epQueue ep)) s) proof (prove)
goal:
No subgoals!