theory IpcCancel_C

lemma cancelIPC_ccorres1:
  assumes cteDeleteOne_ccorres:
  "\<And>w slot. ccorres dc xfdc
   (invs' and cte_wp_at' (\<lambda>ct. w = -1 \<or> cteCap ct = NullCap
        \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = w)) slot)
   ({s. gs_get_assn cteDeleteOne_'proc (ghost'state_' (globals s)) = w}
        \<inter> {s. slot_' s = Ptr slot}) []
   (cteDeleteOne slot) (Call cteDeleteOne_'proc)"
  shows
  "ccorres dc xfdc (tcb_at' thread and invs')
                   (UNIV \<inter> {s. tptr_' s = tcb_ptr_to_ctcb_ptr thread}) []
          (cancelIPC thread) (Call cancelIPC_'proc)" apply (cinit lift: tptr_' simp: Let_def cong: call_ignore_cong) apply (rule ccorres_move_c_guard_tcb) apply csymbr apply (rule getThreadState_ccorres_foo) apply (rule ccorres_symb_exec_r) apply (rule_tac xf'=ret__unsigned_' in ccorres_abstract, ceqv) apply (rule_tac P="rv' = thread_state_to_tsType rv" in ccorres_gen_asm2) apply wpc
            \<comment> \<open>BlockedOnReceive\<close> apply (simp add: word_sle_def "StrictC'_thread_state_defs" ccorres_cond_iffs cong: call_ignore_cong) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (rule ccorres_pre_getEndpoint) apply (rule ccorres_assert) apply (rule ccorres_symb_exec_r) \<comment> \<open>ptr_get lemmas don't work so well :(\<close> apply (rule ccorres_symb_exec_r) apply (simp only: fun_app_def simp_list_case_return
                                  return_bind ccorres_seq_skip) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (ctac (no_vcg) add: cancelIPC_ccorres_helper) apply (ctac add: setThreadState_ccorres_valid_queues') apply (wp hoare_vcg_all_lift set_ep_valid_objs' | simp add: valid_tcb_state'_def split del: if_split)+ apply (simp add: "StrictC'_thread_state_defs") apply vcg apply (rule conseqPre, vcg) apply clarsimp apply clarsimp apply (rule conseqPre, vcg) apply (rule subset_refl) apply (rule conseqPre, vcg) apply clarsimp
          \<comment> \<open>BlockedOnReply case\<close> apply (simp add: "StrictC'_thread_state_defs" ccorres_cond_iffs
                            Collect_False Collect_True word_sle_def
                      cong: call_ignore_cong del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (unfold comp_def)[1] apply csymbr apply (rule ccorres_move_c_guard_tcb)+ apply (rule ccorres_split_nothrow_novcg) apply (rule_tac P=\<top> in threadSet_ccorres_lemma2) apply vcg apply (clarsimp simp: typ_heap_simps') apply (erule(1) rf_sr_tcb_update_no_queue2,
                 (simp add: typ_heap_simps')+)[1] apply (rule ball_tcb_cte_casesI, simp_all)[1] apply (clarsimp simp: ctcb_relation_def seL4_Fault_lift_NullFault
                                     cfault_rel_def cthread_state_relation_def) apply (case_tac "tcbState tcb", simp_all add: is_cap_fault_def)[1] apply ceqv apply ccorres_remove_UNIV_guard apply (rule ccorres_move_array_assertion_tcb_ctes) apply (rule_tac P="tcb_at' thread" in ccorres_cross_over_guard) apply (simp add: getThreadReplySlot_def) apply ctac apply (simp only: liftM_def bind_assoc return_bind del: Collect_const) apply (rule ccorres_pre_getCTE) apply (rename_tac slot slot' cte) apply (rule ccorres_move_c_guard_cte) apply (rule_tac xf'=ret__unsigned_' and val="mdbNext (cteMDBNode cte)"
                         and R="cte_wp_at' ((=) cte) slot and invs'"
                          in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule(1) cmap_relationE1[OF cmap_relation_cte]) apply (clarsimp simp: typ_heap_simps) apply (clarsimp simp: ccte_relation_def map_option_Some_eq2) apply ceqv apply csymbr apply (rule ccorres_Cond_rhs) apply (simp add: nullPointer_def when_def) apply (rule ccorres_symb_exec_l[OF _ _ _ empty_fail_stateAssert]) apply (rule ccorres_symb_exec_r) apply (ctac add: cteDeleteOne_ccorres[where w1="scast cap_reply_cap"]) apply vcg apply (rule conseqPre, vcg, clarsimp simp: rf_sr_def
                       gs_set_assn_Delete_cstate_relation[unfolded o_def]) apply (wp | simp)+ apply (rule ccorres_return_Skip) apply (simp add: guard_is_UNIV_def ghost_assertion_data_get_def
                                ghost_assertion_data_set_def cap_tag_defs) apply (simp add: locateSlot_conv, wp) apply vcg apply (rule_tac Q="\<lambda>rv. tcb_at' thread and invs'" in hoare_post_imp) apply (clarsimp simp: cte_wp_at_ctes_of capHasProperty_def
                                   cap_get_tag_isCap ucast_id) apply (wp threadSet_invs_trivial | simp)+ apply (clarsimp simp add: guard_is_UNIV_def tcbReplySlot_def
                        Kernel_C.tcbReply_def tcbCNodeEntries_def)
          \<comment> \<open>BlockedOnNotification\<close> apply (simp add: word_sle_def "StrictC'_thread_state_defs" ccorres_cond_iffs
                     cong: call_ignore_cong) apply (rule ccorres_symb_exec_r) apply (ctac (no_vcg)) apply clarsimp apply (rule conseqPre, vcg) apply (rule subset_refl) apply (rule conseqPre, vcg) apply clarsimp
         \<comment> \<open>Running, Inactive, and Idle\<close> apply (simp add: word_sle_def "StrictC'_thread_state_defs" ccorres_cond_iffs
                    cong: call_ignore_cong,
                rule ccorres_return_Skip)+
      \<comment> \<open>BlockedOnSend\<close> apply (simp add: word_sle_def "StrictC'_thread_state_defs" ccorres_cond_iffs
                 cong: call_ignore_cong)
      \<comment> \<open>clag\<close> apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (rule ccorres_pre_getEndpoint) apply (rule ccorres_assert) apply (rule ccorres_symb_exec_r) \<comment> \<open>ptr_get lemmas don't work so well :(\<close> apply (rule ccorres_symb_exec_r) apply (simp only: fun_app_def simp_list_case_return return_bind ccorres_seq_skip) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (ctac (no_vcg) add: cancelIPC_ccorres_helper) apply (ctac add: setThreadState_ccorres_valid_queues') apply (wp hoare_vcg_all_lift set_ep_valid_objs' | simp add: valid_tcb_state'_def split del:if_split)+ apply (simp add: "StrictC'_thread_state_defs") apply clarsimp apply (rule conseqPre, vcg, rule subset_refl) apply (rule conseqPre, vcg) apply clarsimp apply clarsimp apply (rule conseqPre, vcg, rule subset_refl) apply (rule conseqPre, vcg) apply clarsimp
  \<comment> \<open>Restart\<close> apply (simp add: word_sle_def "StrictC'_thread_state_defs" ccorres_cond_iffs
                cong: call_ignore_cong,
            rule ccorres_return_Skip)
    \<comment> \<open>Post wp proofs\<close> apply vcg apply clarsimp apply (rule conseqPre, vcg) apply clarsimp apply clarsimp apply (drule(1) obj_at_cslift_tcb) apply clarsimp apply (frule obj_at_valid_objs', clarsimp+) apply (clarsimp simp: projectKOs valid_obj'_def valid_tcb'_def
                        valid_tcb_state'_def typ_heap_simps
                        word_sle_def) apply (rule conjI, clarsimp) apply (rule conjI, clarsimp) apply (rule conjI) subgoal by (auto simp: projectKOs obj_at'_def pred_tcb_at'_def split: thread_state.splits)[1] apply (clarsimp) apply (rule conjI) subgoal by (auto simp: obj_at'_def projectKOs pred_tcb_at'_def invs'_def valid_state'_def
                     isTS_defs cte_wp_at_ctes_of
                     cthread_state_relation_def sch_act_wf_weak valid_ep'_def
             dest!: valid_queues_not_runnable'_not_ksQ[where t=thread] split: thread_state.splits) apply clarsimp apply (frule (2) ep_blocked_in_queueD_recv) apply (frule (1) ko_at_valid_ep'[OF _ invs_valid_objs']) subgoal by (auto simp: obj_at'_def projectKOs pred_tcb_at'_def invs'_def valid_state'_def
                         isTS_defs cte_wp_at_ctes_of isRecvEP_def
                         cthread_state_relation_def sch_act_wf_weak valid_ep'_def
                 dest!: valid_queues_not_runnable'_not_ksQ[where t=thread] split: thread_state.splits endpoint.splits) apply (rule conjI) apply (clarsimp simp: inQ_def) apply (rule conjI) apply clarsimp apply clarsimp apply (rule conjI) subgoal by (auto simp: obj_at'_def projectKOs pred_tcb_at'_def invs'_def valid_state'_def
                         isTS_defs cte_wp_at_ctes_of
                         cthread_state_relation_def sch_act_wf_weak valid_ep'_def
                 dest!: valid_queues_not_runnable'_not_ksQ[where t=thread] split: thread_state.splits) apply clarsimp apply (rule conjI) subgoal by (auto simp: obj_at'_def projectKOs pred_tcb_at'_def invs'_def valid_state'_def
                         isTS_defs cte_wp_at_ctes_of
                         cthread_state_relation_def sch_act_wf_weak valid_ep'_def
                 dest!: valid_queues_not_runnable'_not_ksQ[where t=thread] split: thread_state.splits) apply clarsimp apply (frule (2) ep_blocked_in_queueD_send) apply (frule (1) ko_at_valid_ep'[OF _ invs_valid_objs']) subgoal by (auto simp: obj_at'_def projectKOs pred_tcb_at'_def invs'_def valid_state'_def
                        isTS_defs cte_wp_at_ctes_of isSendEP_def
                        cthread_state_relation_def sch_act_wf_weak valid_ep'_def
                dest!: valid_queues_not_runnable'_not_ksQ[where t=thread] split: thread_state.splits endpoint.splits)[1] apply (auto simp: isTS_defs cthread_state_relation_def typ_heap_simps weak_sch_act_wf_def) apply (case_tac ts,
           auto simp: isTS_defs cthread_state_relation_def typ_heap_simps) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (tcb_at' thread and invs') (UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>) [] (cancelIPC thread) (Call cancelIPC_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>tptr. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> ccorres dc xfdc (?Q1209 tptr) (?Q'1209 tptr) [SKIP] (do state <- getThreadState thread;
case state of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> do ep <- getEndpoint (blockingObject state);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject state) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | Structures_H.thread_state.BlockedOnReply \<Rightarrow> do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od | Structures_H.thread_state.BlockedOnNotification x \<Rightarrow> cancelSignal thread (waitingOnNotification state) | Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<Rightarrow> do ep <- getEndpoint (blockingObject state);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject state) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | _ \<Rightarrow> return ()
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>state___ptr_to_struct_thread_state_C :== PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(\<acute>state___ptr_to_struct_thread_state_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(\<acute>state___ptr_to_struct_thread_state_C);;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(\<acute>state___ptr_to_struct_thread_state_C);;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI))
 2. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1209 tptr s \<and> s' \<in> ?Q'1209 tptr proof (prove)
goal (2 subgoals):
 1. \<And>tptr. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> ccorres dc xfdc (?A1215 tptr) (?C'1215 tptr) [SKIP] (do state <- getThreadState thread;
case state of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> do ep <- getEndpoint (blockingObject state);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject state) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | Structures_H.thread_state.BlockedOnReply \<Rightarrow> do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od | Structures_H.thread_state.BlockedOnNotification x \<Rightarrow> cancelSignal thread (waitingOnNotification state) | Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<Rightarrow> do ep <- getEndpoint (blockingObject state);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject state) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | _ \<Rightarrow> return ()
od) (\<acute>state___ptr_to_struct_thread_state_C :== PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']);;
(\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(\<acute>state___ptr_to_struct_thread_state_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(\<acute>state___ptr_to_struct_thread_state_C);;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(\<acute>state___ptr_to_struct_thread_state_C);;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI))
 2. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A1215 tptr and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> ?C'1215 tptr \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>tptr. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> ccorres dc xfdc (?A1215 tptr) (?G'1219 tptr) [SKIP] (do state <- getThreadState thread;
case state of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> do ep <- getEndpoint (blockingObject state);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject state) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | Structures_H.thread_state.BlockedOnReply \<Rightarrow> do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od | Structures_H.thread_state.BlockedOnNotification x \<Rightarrow> cancelSignal thread (waitingOnNotification state) | Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<Rightarrow> do ep <- getEndpoint (blockingObject state);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject state) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | _ \<Rightarrow> return ()
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A1215 tptr and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> ?G'1219 tptr} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> ccorres dc xfdc (?P1747 tptr rv) (?P'1747 tptr rv) [SKIP] (case rv of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | Structures_H.thread_state.BlockedOnReply \<Rightarrow> do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od | Structures_H.thread_state.BlockedOnNotification x \<Rightarrow> cancelSignal thread (waitingOnNotification rv) | Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<Rightarrow> do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | _ \<Rightarrow> return ()) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> ?P1747 tptr ts s) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> ccorres dc xfdc (?P1747 tptr rv) (?Q'1749 tptr rv) [SKIP] (case rv of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | Structures_H.thread_state.BlockedOnReply \<Rightarrow> do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od | Structures_H.thread_state.BlockedOnNotification x \<Rightarrow> cancelSignal thread (waitingOnNotification rv) | Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<Rightarrow> do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | _ \<Rightarrow> return ()) (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'1749 tptr rv)
 3. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; ?P1747 tptr rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> ?P1747 tptr ts s) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>tptr rv rv'. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> ccorres dc xfdc (?P1747 tptr rv) (?G'1753 tptr rv rv') [SKIP] (case rv of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | Structures_H.thread_state.BlockedOnReply \<Rightarrow> do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od | Structures_H.thread_state.BlockedOnNotification x \<Rightarrow> cancelSignal thread (waitingOnNotification rv) | Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<Rightarrow> do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | _ \<Rightarrow> return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> ?G'1753 tptr rv (ret__unsigned_' s)}
 3. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; ?P1747 tptr rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> ?P1747 tptr ts s) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1747 tptr rv) (?G'2108 tptr rv rv') [SKIP] (case rv of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | Structures_H.thread_state.BlockedOnReply \<Rightarrow> do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od | Structures_H.thread_state.BlockedOnNotification x \<Rightarrow> cancelSignal thread (waitingOnNotification rv) | Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<Rightarrow> do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od | _ \<Rightarrow> return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> ?G'2108 tptr rv (ret__unsigned_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 3. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; ?P1747 tptr rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> ?P1747 tptr ts s) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x11 x12. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnReceive x11 x12\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2136 tptr rv x11 x12) (?R''2134 tptr rv rv' x11 x12) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> ?R''2134 tptr rv (ret__unsigned_' s) x xa}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> ?R2136 tptr rv x xa s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x11 x12. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2136 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12) (?R''2134 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12) [SKIP] (do ep <- getEndpoint x11;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x11 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> ?R''2134 tptr rv (ret__unsigned_' s) x xa}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> ?R2136 tptr rv x xa s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x11 x12. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2136 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12) (?R''2134 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12) [SKIP] (do ep <- getEndpoint x11;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x11 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (lvar_nondet_init epptr_' epptr_'_update;;
(lvar_nondet_init queue_' queue_'_update;;
(\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> ?R''2134 tptr rv (ret__unsigned_' s) x xa}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> ?R2136 tptr rv x xa s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x11 x12. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2136 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12) (?G'2243 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12) [SKIP] (do ep <- getEndpoint x11;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x11 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (lvar_nondet_init queue_' queue_'_update;;
(\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> ?G'2243 tptr rv (ret__unsigned_' s) x xa}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> ?R2136 tptr rv x xa s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x11 x12. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2136 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12) (?G'2262 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12) [SKIP] (do ep <- getEndpoint x11;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x11 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> ?G'2262 tptr rv (ret__unsigned_' s) x xa}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> ?R2136 tptr rv x xa s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P2279 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 a ep) (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) [SKIP] (do y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x11 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'2277 tptr rv (ret__unsigned_' s) x xa ep}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P2279 tptr rv x xa s ep)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) [SKIP] (do ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x11 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'2277 tptr rv (ret__unsigned_' s) x xa ep}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P2284 tptr rv x xa ep s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) (?Q'2287 tptr rv rv' x11 x12 ep) [SKIP] (do ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x11 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))))))
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 3. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) (?Q'2293 tptr rv rv' x11 x12 ep) [SKIP] (do ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x11 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'2293 tptr rv rv' x11 x12 ep)
 3. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 5. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) (?Q'2293 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) [SKIP] (do y <- setEndpoint x11 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep);
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'2293 tptr rv rv' x11 x12 ep)
 3. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 5. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) (?Q'2293 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) [SKIP] (do y <- setEndpoint x11 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep);
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))))
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'2293 tptr rv rv' x11 x12 ep)
 3. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 5. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) (?Q'2293 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) [SKIP] (do y <- setEndpoint x11 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep);
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'2293 tptr rv rv' x11 x12 ep)
 3. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 5. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) (?Q'2293 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) [SKIP] (do y <- setEndpoint x11 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep);
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'2293 tptr rv rv' x11 x12 ep)
 3. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 5. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P2284 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep rva xfdca. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2314 tptr rv rv' x11 x12 ep rva) (?Q'2314 tptr rv rv' x11 x12 ep rva xfdca) [SKIP] (setThreadState Structures_H.thread_state.Inactive thread) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<lbrace>?R2318 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep\<rbrace> setEndpoint x11 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) \<lbrace>?Q2314 tptr rv rv' x11 x12 ep\<rbrace>
 3. \<And>tptr rv rv' x11 x12 ep s rva. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'2314 tptr rv rv' x11 x12 ep rva (xfdc s)
 4. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned \<lbrace>\<acute>epptr = ep_Ptr x11\<rbrace>
 5. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and ?R2318 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 7. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and ?R2318 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<lbrace>?R2318 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep\<rbrace> setEndpoint x11 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) \<lbrace>\<lambda>a b. tcb_at' thread b \<and> valid_queues' b \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> Invariants_H.valid_queues b \<and> (\<forall>p. thread \<notin> set (ksReadyQueues b p)) \<and> sch_act_not thread b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b\<rbrace>
 2. \<And>tptr rv rv' x11 x12 ep s rva. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned \<lbrace>\<acute>epptr = ep_Ptr x11\<rbrace>
 4. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and ?R2318 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 6. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and ?R2318 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) x11 x12 ep) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> s \<in> (if SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive then UNIV else {})
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned \<lbrace>\<acute>epptr = ep_Ptr x11\<rbrace>
 3. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 5. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned \<lbrace>\<acute>epptr = ep_Ptr x11\<rbrace>
 2. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2287 tptr rv rv' x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'2287 tptr rv rv' x11 x12 ep)
 4. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x11\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) \<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x11\<rbrace>
 3. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x11\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, epptr_'_update (\<lambda>_. ep_Ptr (ret__unsigned_' sa)) sa) \<in> rf_sr}
 2. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) \<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x11\<rbrace>
 3. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) \<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x11\<rbrace>
 2. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'2277 tptr rv (ret__unsigned_' s) x xa ep}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x11 x12 ep. \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False) \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) \<lbrace>\<acute>ret__unsigned = x11\<rbrace>
 2. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'2277 tptr rv (ret__unsigned_' s) x xa ep}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x11 x12 ep. \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False) \<Longrightarrow> ?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<subseteq> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x11)}
 2. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2277 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnReceive x11 x12) 3 x11 x12 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'2277 tptr rv (ret__unsigned_' s) x xa ep}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x11)} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x11 x12 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 3; rv = Structures_H.thread_state.BlockedOnReceive x11 x12; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x11) thread and ko_at' ep x11 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x11)} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := blockingObject_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''])))))\<rparr>) \<in> rf_sr)}
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 tptr rv) (?R''2131 tptr rv rv') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> ?R2137 tptr ts s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply) (?R''2131 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5) [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> ?R2137 tptr ts s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply) (?R''2131 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5) [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (lvar_nondet_init slot_' slot_'_update;;
(lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
(\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)))))))
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> ?R''2131 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> ?R2137 tptr ts s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply) (?G'2518 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5) [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
(\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))))))
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> {sa. \<forall>v. slot_'_update (\<lambda>_. v) sa \<in> ?G'2518 tptr rv (ret__unsigned_' s)}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> ?R2137 tptr ts s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply) (?G'2537 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5) [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (mdbNext \<circ> cteMDBNode) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)))))
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> {sa. \<forall>v. slot_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. sa\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> ?G'2537 tptr rv (ret__unsigned_' s)}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> ?R2137 tptr ts s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply) (?G'2537 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5) [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)))))
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> {sa. \<forall>v. slot_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. sa\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> ?G'2537 tptr rv (ret__unsigned_' s)}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> ?R2137 tptr ts s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2137 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply) (?G'2562 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C) [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C)));;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))))
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> {sa. \<forall>v. slot_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. sa\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {sa. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> sa\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> ?G'2562 tptr rv (ret__unsigned_' s) v}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> ?R2137 tptr rv s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> ?R2137 tptr ts s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A2739 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply) (?C'2736 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C) [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. None)) thread;
slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C));;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))))
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({sa. awaiting_reply' rv \<longrightarrow> sa \<in> {sa. \<forall>v. slot_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. sa\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {sa. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> sa\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> ?C'2736 tptr rv (ret__unsigned_' s) v \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (?A2739 tptr rv and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (?A2739 tptr ts and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (14 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ccorres (?r'2742 tptr rv rv' ret__struct_seL4_Fault_C) (?xf'2742 tptr rv rv' ret__struct_seL4_Fault_C) (?P2748 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply) (?C'2736 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C) [] (threadSet (tcbFault_update (\<lambda>_. None)) thread) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C)))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2742 tptr rv rv' ret__struct_seL4_Fault_C) rv'a t t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ?r'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'2742 tptr rv rv' ret__struct_seL4_Fault_C) (?xf'2742 tptr rv rv' ret__struct_seL4_Fault_C) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C)
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C s tcb. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q2755 tptr rv rv' ret__struct_seL4_Fault_C s tcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C)) {s'. (s\<lparr>ksPSpace := (ksPSpace s)(thread \<mapsto> injectKOS (tcbFault_update (\<lambda>_. None) tcb))\<rparr>, s') \<in> rf_sr}
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; (s, s') \<in> rf_sr; True; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> ?Q2755 tptr rv rv' ret__struct_seL4_Fault_C s tcb
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C)
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; (s, s') \<in> rf_sr; True; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {sa. (s\<lparr>ksPSpace := (ksPSpace s)(thread \<mapsto> injectKOS (tcbFault_update (\<lambda>_. None) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C))) sa) \<in> rf_sr}
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C)
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; (s, s') \<in> rf_sr; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(thread \<mapsto> KOTCB (tcbFault_update (\<lambda>_. None) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C))) s') \<in> rf_sr
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C)
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> getF (tcbFault_update (\<lambda>_. None) tcb) = getF tcb
 2. \<And>ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> ctcb_relation (tcbFault_update (\<lambda>_. None) tcb) (tcbFault_C_update (\<lambda>_. ret__struct_seL4_Fault_C) tcb')
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C)
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> ctcb_relation (tcbFault_update (\<lambda>_. None) tcb) (tcbFault_C_update (\<lambda>_. ret__struct_seL4_Fault_C) tcb')
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C)
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>ret__struct_seL4_Fault_C s s' tcb tcb' cf'. \<lbrakk>seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb'; cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), Some cf'); tcbIPCBuffer tcb = tcbIPCBuffer_C tcb'; carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb'); tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))); UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb'; UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb'; UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb'; tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb'); option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; seL4_Fault_lift (tcbFault_C tcb') = Some cf'; if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (tcbLookupFailure_C tcb') = Some lf' \<and> fault_to_H cf' lf' = tcbFault tcb else fault_to_H cf' undefined = tcbFault tcb\<rbrakk> \<Longrightarrow> (is_cap_fault SeL4_Fault_NullFault \<longrightarrow> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), Some SeL4_Fault_NullFault) \<and> (\<exists>lf'. lookup_fault_lift (tcbLookupFailure_C tcb') = Some lf')) \<and> (\<not> is_cap_fault SeL4_Fault_NullFault \<longrightarrow> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), Some SeL4_Fault_NullFault))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C)
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (?d'2742 tptr rv rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C)
 5. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2742 tptr rv rv' ret__struct_seL4_Fault_C)
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a rv'b. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2742 tptr rv rv' ret__struct_seL4_Fault_C rva) (?G'2814 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a rv'b) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>?Q2742 tptr rv rv' ret__struct_seL4_Fault_C\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> ?G'2814 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()})
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a rv'b. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A2852 tptr rv rv' ret__struct_seL4_Fault_C rva) (?C'2851 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a rv'b) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. ?A2852 tptr rv rv' ret__struct_seL4_Fault_C rva and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> ?C'2851 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a () \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva rv'a rv'b. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'2856 tptr rv rv' ret__struct_seL4_Fault_C rva) (?Q2855 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a rv'b) [SKIP] (do slot <- getThreadReplySlot thread;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ?P'2856 tptr rv rv' ret__struct_seL4_Fault_C rva and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> ?Q2855 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'2856 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()) (?Q2855 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) [SKIP] (do slot <- locateSlotTCB thread tcbReplySlot;
callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE slot);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (\<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ?P'2856 tptr rv rv' ret__struct_seL4_Fault_C rva and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> ?Q2855 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a rva slot. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot = cte_Ptr rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2872 tptr rv rv' ret__struct_seL4_Fault_C rv'a rva) (?Q'2872 tptr rv rv' ret__struct_seL4_Fault_C rv'a rva slot) [SKIP] (do callerCap <- liftM (\<lambda>x. mdbNext (cteMDBNode x)) (getCTE rva);
when (callerCap \<noteq> nullPointer) (do y <- stateAssert (capHasProperty callerCap (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne callerCap
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>?Q2872 tptr rv rv' ret__struct_seL4_Fault_C rv'a\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rva. slot_' s = cte_Ptr rva \<longrightarrow> s \<in> ?Q'2872 tptr rv rv' ret__struct_seL4_Fault_C rv'a rva (slot_' s)}
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a rva slot. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot = cte_Ptr rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2872 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a rva) (?Q'2872 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a rva (cte_Ptr rva)) [SKIP] (do x <- getCTE rva;
when (mdbNext (cteMDBNode x) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode x)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode x))
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rva} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr rva\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>?Q2872 tptr rv rv' ret__struct_seL4_Fault_C rv'a\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rva. slot_' s = cte_Ptr rva \<longrightarrow> s \<in> ?Q'2872 tptr rv rv' ret__struct_seL4_Fault_C rv'a rva (slot_' s)}
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a rva slot x. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot = cte_Ptr rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P3014 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a rva a x) (?P'3016 ret__struct_seL4_Fault_C rv'a rva x) [SKIP] (when (mdbNext (cteMDBNode x) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode x)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode x))
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rva} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr rva\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ?P3014 tptr rv rv' ret__struct_seL4_Fault_C rv'a a b cte\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rva. slot_' s = cte_Ptr rva \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?P'3015 tptr rv rv' ret__struct_seL4_Fault_C rv'a rva (slot_' s) cte'}}
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>ret__struct_seL4_Fault_C rv'a rva cte'. ?P'3016 ret__struct_seL4_Fault_C rv'a rva (cte_to_H cte') \<equiv>\<^sup>? \<lambda>ret__struct_seL4_Fault_C rv'a rva. ?P'3015 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a rva (cte_Ptr rva) proof (prove)
goal (14 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P3014 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot a cte) (?P'3016 ret__struct_seL4_Fault_C rv'a slot cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ?P3014 tptr rv rv' ret__struct_seL4_Fault_C rv'a a b cte\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rva. slot_' s = cte_Ptr rva \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?P'3015 tptr rv rv' ret__struct_seL4_Fault_C rv'a rva (slot_' s) cte'}}
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>ret__struct_seL4_Fault_C rv'a rva cte'. ?P'3016 ret__struct_seL4_Fault_C rv'a rva (cte_to_H cte') \<equiv>\<^sup>? \<lambda>ret__struct_seL4_Fault_C rv'a rva. ?P'3015 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a rva (cte_Ptr rva) proof (prove)
goal (14 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3024 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?C'3023 ret__struct_seL4_Fault_C rv'a slot cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])));;
(\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?A3024 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rva. slot_' s = cte_Ptr rva \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?C'3022 tptr rv rv' ret__struct_seL4_Fault_C rv'a rva (slot_' s) cte' \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>ret__struct_seL4_Fault_C rv'a rva cte'. ?C'3023 ret__struct_seL4_Fault_C rv'a rva (cte_to_H cte') \<equiv>\<^sup>? \<lambda>ret__struct_seL4_Fault_C rv'a rva. ?C'3022 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a rva (cte_Ptr rva) proof (prove)
goal (17 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (cte_wp_at' ((=) cte) slot and invs') s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = mdbNext (cteMDBNode cte)\<rbrace>)
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'b t t' (\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3030 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte (mdbNext (cteMDBNode cte)))
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. ?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P3030 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 9. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ret__struct_seL4_Fault_C slot cte s. seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<Longrightarrow> UNIV \<inter> {s'. (cte_wp_at' ((=) cte) slot and invs') s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>ret__unsigned. ret__unsigned = mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))))\<rparr>) \<in> rf_sr \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) = mdbNext (cteMDBNode cte)}
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'b t t' (\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3030 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte (mdbNext (cteMDBNode cte)))
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. ?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P3030 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 9. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ret__struct_seL4_Fault_C slot cte s x. \<lbrakk>seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ctes_of s slot = Some cte; invs' s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) = mdbNext (cteMDBNode cte)
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'b t t' (\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3030 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte (mdbNext (cteMDBNode cte)))
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. ?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P3030 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 9. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ret__struct_seL4_Fault_C slot cte s x y'. \<lbrakk>seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ctes_of s slot = Some cte; invs' s; ctes_of s slot = Some cte; ccte_relation cte y'; cslift x (cte_Ptr slot) = Some y'\<rbrakk> \<Longrightarrow> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) = mdbNext (cteMDBNode cte)
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'b t t' (\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3030 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte (mdbNext (cteMDBNode cte)))
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. ?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P3030 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 9. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ret__struct_seL4_Fault_C slot cte s x y'. \<lbrakk>seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; invs' s; ctes_of s slot = Some cte; ccte_relation cte y'; cslift x (cte_Ptr slot) = Some y'\<rbrakk> \<Longrightarrow> mdbNext_CL (mdb_node_lift (cteMDBNode_C y')) = mdbNext (cteMDBNode cte)
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'b t t' (\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3030 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte (mdbNext (cteMDBNode cte)))
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. ?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P3030 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 9. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b t t'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'b t t' (\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rv'b)
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3030 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (?y'3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte (mdbNext (cteMDBNode cte)))
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. ?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P3030 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 8. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3030 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr (mdbNext (cteMDBNode cte));;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI)
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. ?Q3027 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P3030 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3030 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?G'3148 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (IF cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(cte_Ptr (mdbNext (cteMDBNode cte)))
FI)
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> ?G'3148 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte})
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> (?P3030 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3221 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?S3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) (\<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(cte_Ptr (mdbNext (cteMDBNode cte))))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; \<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3220 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) SKIP
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?S3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)}})
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>b. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?Q3221 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?R3220 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 8. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3221 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?S3219 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte) [SKIP] (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od) (\<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(cte_Ptr (mdbNext (cteMDBNode cte))))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; \<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3220 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) SKIP
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?S3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)}})
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>b. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?Q3221 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?R3220 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 8. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3238 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte rva) (?Q'3236 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte rva) [SKIP] (cteDeleteOne (mdbNext (cteMDBNode cte))) (\<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)));;
CALL cteDeleteOne_'proc(cte_Ptr (mdbNext (cteMDBNode cte))))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q3221 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>?Q3238 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte\<rbrace>
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; \<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3220 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) SKIP
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q3238 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva s \<longrightarrow> s' \<in> ?Q'3236 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)}})
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>b. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?Q3221 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?R3220 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 9. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 10. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3238 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte rva) (?Q'3243 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva) [SKIP] (cteDeleteOne (mdbNext (cteMDBNode cte))) (CALL cteDeleteOne_'proc(cte_Ptr (mdbNext (cteMDBNode cte))))
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3236 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte rva) \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x))) (?Q'3243 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva)
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0; ?Q3238 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3236 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x))) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q3221 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>?Q3238 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; \<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3220 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) SKIP
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q3238 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva s \<longrightarrow> s' \<in> ?Q'3236 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)}})
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>b. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?Q3221 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?R3220 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 9. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3236 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte rva) \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x))) {s. slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode cte))) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode cte))\<rbrace>}
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0; (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3236 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x))) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q3221 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; \<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3220 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) SKIP
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) s \<longrightarrow> s' \<in> ?Q'3236 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)}})
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>b. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?Q3221 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?R3220 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 10. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte rva s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0; (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> cte_Ptr (mdbNext (cteMDBNode cte)) = cte_Ptr (mdbNext (cteMDBNode cte))\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x))) {s'. (s, s') \<in> rf_sr}
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q3221 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))\<rbrace>
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; \<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3220 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) SKIP
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) s \<longrightarrow> s' \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> cte_Ptr (mdbNext (cteMDBNode cte)) = cte_Ptr (mdbNext (cteMDBNode cte))\<rbrace>}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)}})
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>b. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?Q3221 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?R3220 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 9. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 10. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q3221 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte\<rbrace> stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [] \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; \<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3220 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte) [SKIP] (when (mdbNext (cteMDBNode cte) \<noteq> nullPointer) (do y <- stateAssert (capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap)) [];
cteDeleteOne (mdbNext (cteMDBNode cte))
od)) SKIP
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) s \<longrightarrow> s' \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> cte_Ptr (mdbNext (cteMDBNode cte)) = cte_Ptr (mdbNext (cteMDBNode cte))\<rbrace>}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)}})
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>b. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?Q3221 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?R3220 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 8. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 9. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 17 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot; mdbNext (cteMDBNode cte) = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3220 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot cte) (?T3219 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C rv'a slot (cte_Ptr slot) cte) [SKIP] (return ()) SKIP
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rva rv'b. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) s \<longrightarrow> s' \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> cte_Ptr (mdbNext (cteMDBNode cte)) = cte_Ptr (mdbNext (cteMDBNode cte))\<rbrace>}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> ?T3219 tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte)}})
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>b. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap) b \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) b) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> ?R3220 tptr rv rv' ret__struct_seL4_Fault_C rv'a a cte b)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 6. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 7. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a slot slot' cte. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; slot' = cte_Ptr slot\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = mdbNext (cteMDBNode cte)) ret__unsigned_' (\<lambda>rv rv'. {s. s\<lparr>callerCap___ptr_to_struct_cte_C_' := cte_Ptr (mdbNext (cteMDBNode cte))\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) s \<longrightarrow> s' \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> cte_Ptr (mdbNext (cteMDBNode cte)) = cte_Ptr (mdbNext (cteMDBNode cte))\<rbrace>}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> s \<in> UNIV)}})
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>a. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap) a \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) a) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> True)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 5. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 6. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2880 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C ()\<rbrace> locateSlotTCB thread tcbReplySlot \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b a = Some cte \<longrightarrow> ((\<lambda>a. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap) a \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte))) a) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> True)) and (cte_wp_at' ((=) cte) a and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr a))) b\<rbrace>
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and ?R2880 tptr rv rv' ret__struct_seL4_Fault_C rva) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 4. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 5. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2874 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply 5 ret__struct_seL4_Fault_C () rv'a ()) \<acute>slot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) {s. \<forall>rv. slot_' s = cte_Ptr rv \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (slot_' s) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and (\<lambda>a. \<forall>cte. ctes_of a (thread + 2 ^ cte_level_bits * tcbReplySlot) = Some cte \<longrightarrow> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap) a \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte)) a) \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbReplySlot) a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbReplySlot) a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> ?R'2874 tptr rv rv' ret__struct_seL4_Fault_C rva rv'a ()} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rva. tcb_at' thread and ((\<lambda>a. True) and (\<lambda>a. \<forall>cte. ctes_of a (thread + 2 ^ cte_level_bits * tcbReplySlot) = Some cte \<longrightarrow> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap) a \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte)) a) \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbReplySlot) a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbReplySlot) a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))\<rbrace>
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> {s. \<forall>rv. cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr rv \<longrightarrow> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> True \<and> True)}} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and ?R2746 tptr rv and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C rva s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; (tcb_at' thread and invs') s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ((\<lambda>a. True) and (\<lambda>a. \<forall>cte. ctes_of a (thread + 2 ^ cte_level_bits * tcbReplySlot) = Some cte \<longrightarrow> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> capHasProperty (mdbNext (cteMDBNode cte)) (\<lambda>cap. isReplyCap cap \<and> \<not> capReplyMaster cap) a \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (mdbNext (cteMDBNode cte)) a) \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbReplySlot) a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbReplySlot) a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread))) s
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rv. tcb_at' thread and invs'\<rbrace>
 3. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> {s. \<forall>rv. cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr rv \<longrightarrow> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> True \<and> True)}} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 4. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 10. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R2746 (tcb_ptr_to_ctcb_ptr thread) Structures_H.thread_state.BlockedOnReply\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) thread \<lbrace>\<lambda>rv. tcb_at' thread and invs'\<rbrace>
 2. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcb_at' thread s \<longrightarrow> s' \<in> \<lbrace>thread = ptr_val tptr && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply\<rbrace> \<inter> {s. \<forall>rv. cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr rv \<longrightarrow> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> True \<and> True)}} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbReply \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbReply + 1 | False \<Rightarrow> sint Kernel_C.tcbReply) \<le> uint tcbCNodeEntries\<rbrace>})
 3. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and ?R2746 tptr rv and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv' ret__struct_seL4_Fault_C. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 5; awaiting_reply' rv; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> (thread = ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00 \<and> tcbReplySlot = SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply \<longrightarrow> (0 \<le> sint Kernel_C.tcbReply \<and> sint Kernel_C.tcbReply \<le> uint tcbCNodeEntries \<longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rva rv'a. UNIV)) \<and> ((0 \<le> sint Kernel_C.tcbReply \<longrightarrow> \<not> sint Kernel_C.tcbReply \<le> uint tcbCNodeEntries) \<longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rva rv'a. {}))) \<and> ((thread = ptr_val (tcb_ptr_to_ctcb_ptr thread) && 0xFFFFFE00 \<longrightarrow> tcbReplySlot \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply) \<longrightarrow> (0 \<le> sint Kernel_C.tcbReply \<and> sint Kernel_C.tcbReply \<le> uint tcbCNodeEntries \<longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rva rv'a. {s. \<forall>sa. (sa, s) \<in> rf_sr \<longrightarrow> \<not> tcb_at' thread sa})) \<and> ((0 \<le> sint Kernel_C.tcbReply \<longrightarrow> \<not> sint Kernel_C.tcbReply \<le> uint tcbCNodeEntries) \<longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rva rv'a. {})))
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 tptr rv x3) (?R''2130 tptr rv rv' x3) [SKIP] (cancelSignal thread (waitingOnNotification rv)) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) x3) (?R''2130 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) 6 x3) [SKIP] (cancelSignal thread x3) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr ts x s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2138 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) x3) (?Q'3334 tptr rv rv' x3) [SKIP] (cancelSignal thread x3) (CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)))
 2. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''2130 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) 6 x3) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3334 tptr rv rv' x3)
 3. \<And>tptr rv rv' x3 s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3; ?R2138 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) x3 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''2130 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) 6 x3 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> ?R2138 tptr rv x s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv' x3. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''2130 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) 6 x3) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (UCAST(32 \<rightarrow> 32) (ret__unsigned_' s))) (threadPtr_'_update (\<lambda>_. tptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>threadPtr = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr x3\<rbrace>}
 2. \<And>tptr rv rv' x3 s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3; (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x3)) thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''2130 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) 6 x3 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>x3. \<Gamma>\<turnstile> (?R''2130 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) 6 x3) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) \<lbrace>\<acute>ret__unsigned = x3\<rbrace>
 2. \<And>tptr rv rv' x3 s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3; (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x3)) thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''2130 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) 6 x3 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>x3. ?R''2130 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) 6 x3 \<subseteq> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x3)}
 2. \<And>tptr rv rv' x3 s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3; (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x3)) thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''2130 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnNotification x3) 6 x3 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> sa \<in> ?R''2130 tptr rv (ret__unsigned_' s) x}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x3 s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3; (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x3)) thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x3)} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x3 s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 6; rv = Structures_H.thread_state.BlockedOnNotification x3; (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x3)) thread) s\<rbrakk> \<Longrightarrow> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x3)} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := blockingObject_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''])))))\<rparr>) \<in> rf_sr)}
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2139 tptr rv) (?R''2128 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2140 tptr rv) (?R''2127 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2141 tptr rv) (?R''2126 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({sa. rv = Structures_H.thread_state.Running \<longrightarrow> sa \<in> ?R''2128 tptr rv (ret__unsigned_' s)} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''2127 tptr rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''2126 tptr rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 7. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr rv s) \<and> (idle' rv \<longrightarrow> ?R2141 tptr rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> ?R2139 tptr ts s) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> ?R2140 tptr ts s) \<and> (idle' ts \<longrightarrow> ?R2141 tptr ts s) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 tptr rv x71 x72 x73 x74 x75) (?R''2125 tptr rv rv' x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint (blockingObject rv);
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint (blockingObject rv) ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 4. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75) (?R''2125 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint x71;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x71 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 4. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75) (?R''2125 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint x71;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x71 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (lvar_nondet_init epptr_' epptr_'_update;;
(lvar_nondet_init queue_' queue_'_update;;
(\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''2125 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 4. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75) (?G'3441 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint x71;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x71 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (lvar_nondet_init queue_' queue_'_update;;
(\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> ?G'3441 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 4. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2142 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75) (?G'3460 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75) [SKIP] (do ep <- getEndpoint x71;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x71 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> ?G'3460 tptr rv (ret__unsigned_' s) x xa xb xc xd}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 4. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R2142 tptr ts x xa xb xc xd s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P3477 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 a ep) (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) [SKIP] (do y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x71 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 4. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3477 tptr rv x xa xb xc xd s ep)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3477 tptr ts x xa xb xc xd s ep)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) [SKIP] (do ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x71 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))))
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 4. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr rv x xa xb xc xd ep s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr ts x xa xb xc xd ep s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) [SKIP] (do ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x71 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))))))
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 6. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr rv x xa xb xc xd ep s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr ts x xa xb xc xd ep s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) (?Q'3491 tptr rv rv' x71 x72 x73 x74 x75 ep) [SKIP] (do ep' <- case remove1 thread (epQueue ep) of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep;
y <- setEndpoint x71 ep';
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'3491 tptr rv rv' x71 x72 x73 x74 x75 ep)
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr rv x xa xb xc xd ep s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr ts x xa xb xc xd ep s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) (?Q'3491 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) [SKIP] (do y <- setEndpoint x71 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep);
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))))
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'3491 tptr rv rv' x71 x72 x73 x74 x75 ep)
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr rv x xa xb xc xd ep s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr ts x xa xb xc xd ep s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) (?Q'3491 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) [SKIP] (do y <- setEndpoint x71 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep);
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))))
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'3491 tptr rv rv' x71 x72 x73 x74 x75 ep)
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr rv x xa xb xc xd ep s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr ts x xa xb xc xd ep s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) (?Q'3491 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) [SKIP] (do y <- setEndpoint x71 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep);
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'3491 tptr rv rv' x71 x72 x73 x74 x75 ep)
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr rv x xa xb xc xd ep s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr ts x xa xb xc xd ep s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) (?Q'3491 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) [SKIP] (do y <- setEndpoint x71 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep);
setThreadState Structures_H.thread_state.Inactive thread
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned (?Q'3491 tptr rv rv' x71 x72 x73 x74 x75 ep)
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); ?P3482 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr rv x xa xb xc xd ep s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> ?P3482 tptr ts x xa xb xc xd ep s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep rva xfdca. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3512 tptr rv rv' x71 x72 x73 x74 x75 ep rva) (?Q'3512 tptr rv rv' x71 x72 x73 x74 x75 ep rva xfdca) [SKIP] (setThreadState Structures_H.thread_state.Inactive thread) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<lbrace>?R3516 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep\<rbrace> setEndpoint x71 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) \<lbrace>?Q3512 tptr rv rv' x71 x72 x73 x74 x75 ep\<rbrace>
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s rva. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3512 tptr rv rv' x71 x72 x73 x74 x75 ep rva (xfdc s)
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned \<lbrace>\<acute>epptr = ep_Ptr x71\<rbrace>
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and ?R3516 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 7. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and ?R3516 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 9. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 10. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and ?R3516 tptr rv x xa xb xc xd ep) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<lbrace>?R3516 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep\<rbrace> setEndpoint x71 (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) \<lbrace>\<lambda>a b. tcb_at' thread b \<and> valid_queues' b \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> Invariants_H.valid_queues b \<and> (\<forall>p. thread \<notin> set (ksReadyQueues b p)) \<and> sch_act_not thread b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b\<rbrace>
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s rva. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned \<lbrace>\<acute>epptr = ep_Ptr x71\<rbrace>
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and ?R3516 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 6. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and ?R3516 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) x71 x72 x73 x74 x75 ep) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 8. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 9. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and ?R3516 tptr rv x xa xb xc xd ep) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and ?R3516 tptr ts x xa xb xc xd ep) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> s \<in> (if SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive then UNIV else {})
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned \<lbrace>\<acute>epptr = ep_Ptr x71\<rbrace>
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 5. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 7. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 8. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned \<lbrace>\<acute>epptr = ep_Ptr x71\<rbrace>
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 7. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>x71 x72 x73 x74 x75 ep. \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False) \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned \<lbrace>\<acute>epptr = ep_Ptr x71\<rbrace>
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) (?Q'3485 tptr rv rv' x71 x72 x73 x74 x75 ep)
 4. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 6. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 7. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x71\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>epptr :== ep_Ptr \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) \<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x71\<rbrace>
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 6. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x71\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, epptr_'_update (\<lambda>_. ep_Ptr (ret__unsigned_' sa)) sa) \<in> rf_sr}
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) \<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x71\<rbrace>
 3. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 5. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 6. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) \<lbrace>ep_Ptr \<acute>ret__unsigned = ep_Ptr x71\<rbrace>
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 5. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>x71 x72 x73 x74 x75 ep. \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False) \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) \<lbrace>\<acute>ret__unsigned = x71\<rbrace>
 2. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3475 (tcb_ptr_to_ctcb_ptr thread) (Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75) 4 x71 x72 x73 x74 x75 ep \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 4. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> {sa. \<forall>v. epptr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> ?P'3475 tptr rv (ret__unsigned_' s) x xa xb xc xd ep}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 5. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x71)} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 4. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>tptr rv rv' x71 x72 x73 x74 x75 ep s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = 4; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x71) thread and ko_at' ep x71 and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s\<rbrakk> \<Longrightarrow> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x71)} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := blockingObject_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''])))))\<rparr>) \<in> rf_sr)}
 2. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 3. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 4. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>tptr rv rv'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; rv' = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2143 tptr rv) (?R''2119 tptr rv rv') [SKIP] (return ()) (IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<or> rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend THEN
  lvar_nondet_init epptr_' epptr_'_update;;
lvar_nondet_init queue_' queue_'_update;;
\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tptr,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL setThreadState_'proc(tptr,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification THEN
  \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingObject_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C'']));;
CALL cancelSignal_'proc(tptr,ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReply THEN
  lvar_nondet_init slot_' slot_'_update;;
lvar_nondet_init callerCap___ptr_to_struct_cte_C_' callerCap___ptr_to_struct_cte_C_'_update;;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptr\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val tptr && 0xFFFFFE00)) (sint Kernel_C.tcbReply) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr ((ptr_val tptr && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbReply * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>callerCap___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>callerCap___ptr_to_struct_cte_C \<noteq> NULL THEN
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(\<acute>callerCap___ptr_to_struct_cte_C)
FI
FI
FI
FI)
 2. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''2119 tptr rv (ret__unsigned_' s)})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 3. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr rv s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?R2143 tptr ts s)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>tptr rv. tptr = tcb_ptr_to_ctcb_ptr thread \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s. s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>callerCap___ptr_to_struct_cte_C_' := v\<rparr> \<in> {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> {s. \<forall>v. epptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x))) \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)}}}}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV})))))) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = thread_state_to_tsType rv\<rbrace>}
 2. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'1747 tptr rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1747 tptr ts}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>tptr rv s. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' rv \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) rv) thread) s) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = thread_state_to_tsType rv)} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 2. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = thread_state_to_tsType ts)}}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv s. \<lbrakk>\<forall>x. (\<exists>xa. rv = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. ko_at' ep x s \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> tcb_at' thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s); awaiting_reply' rv \<longrightarrow> tcb_at' thread s \<and> invs' s \<and> tcb_at' thread s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p))) \<and> tcb_at' thread s; \<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> invs' s \<and> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s; \<forall>x. (\<exists>xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. ko_at' ep x s \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> tcb_at' thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread)))))) \<longrightarrow> (\<forall>x. (\<exists>xa. rv = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x)))) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread)))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))))) = x)) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread)))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))))) = x)) \<and> (\<forall>x. (\<exists>xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x)))) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread)))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))))) = x)) \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))))) = thread_state_to_tsType rv)} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) {s'. (s, s') \<in> rf_sr}
 2. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = thread_state_to_tsType ts)}}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv s. \<lbrakk>\<forall>x. (\<exists>xa. rv = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. ko_at' ep x s \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> tcb_at' thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s); awaiting_reply' rv \<longrightarrow> tcb_at' thread s \<and> invs' s \<and> tcb_at' thread s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p))) \<and> tcb_at' thread s; \<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> invs' s \<and> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s; \<forall>x. (\<exists>xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. ko_at' ep x s \<longrightarrow> invs' s \<and> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> tcb_at' thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)\<rbrakk> \<Longrightarrow> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread)))))) \<longrightarrow> (\<forall>x. (\<exists>xa. rv = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x)))) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread)))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))))) = x)) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread)))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))))) = x)) \<and> (\<forall>x. (\<exists>xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x)))) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread)))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))))) = x)) \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))))) = thread_state_to_tsType rv)} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := tsType_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C''])) [''tcbState_C''])))))\<rparr>) \<in> rf_sr)}
 2. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = thread_state_to_tsType ts)}}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>tptr s s'. \<lbrakk>tptr = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (tcb_at' thread and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (awaiting_reply' ts \<longrightarrow> (tcb_at' thread and (\<lambda>_. True) and (\<lambda>a. obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> invs' a \<and> tcb_at' thread a \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues a (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread a \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues a (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> ex_nonz_cap_to' thread a \<and> thread \<noteq> ksCurThread a) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. None) tcb) \<and> ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> thread \<noteq> ksCurThread a)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (invs' and st_tcb_at' ((=) ts) thread) s) \<and> (ts = Structures_H.thread_state.Running \<longrightarrow> True) \<and> (ts = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' ts \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (ep_at' x and (\<lambda>s. \<forall>ep. ko_at' ep x s \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread and ko_at' ep x and (\<lambda>a. tcb_at' thread a \<and> valid_queues' a \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x. thread \<notin> set (ksReadyQueues a x)) \<and> sch_act_not thread a \<and> (valid_objs' and valid_ep' (if remove1 thread (epQueue ep) = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep)) a \<and> True)) s)) s) \<and> (ts = Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr tptr)) s \<and> s' \<in> {s. s\<lparr>state___ptr_to_struct_thread_state_C_' := PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])\<rparr> \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (\<forall>x xa. ts = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x)) \<and> (\<forall>x xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> (\<forall>ep. cendpoint_relation (cslift s) ep (the (cslift s (ep_Ptr x))) \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = x))) \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(tptr\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = thread_state_to_tsType ts)}}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; tcb_at' thread s; invs' s\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))) \<and> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))) \<and> (\<forall>ts tcb'. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C tcb'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C tcb'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C tcb')) = x)) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C tcb'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C tcb')) = x)) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C tcb'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C tcb')) = x)) \<and> tsType_CL (thread_state_lift (tcbState_C tcb')) = thread_state_to_tsType ts)) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; \<exists>ko ko'. ko_at' ko thread s \<and> True \<and> cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))) \<and> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))) \<and> (\<forall>ts tcb'. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C tcb'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C tcb'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C tcb')) = x)) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C tcb'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C tcb')) = x)) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C tcb'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C tcb')) = x)) \<and> tsType_CL (thread_state_lift (tcbState_C tcb')) = thread_state_to_tsType ts)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))) \<and> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))) \<and> (\<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x)) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x)) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x)) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; (\<forall>koa. projectKO_opt koa = Some ko \<longrightarrow> KOTCB ko = koa) \<longrightarrow> valid_obj' (KOTCB ko) s\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))) \<and> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))) \<and> (\<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x)) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x)) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x)) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) thread s \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))) \<and> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))) \<and> (\<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts) proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))) \<and> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s\<rbrakk> \<Longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))
 2. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (4 subgoals):
 1. \<And>s s' ko ko' x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s\<rbrakk> \<Longrightarrow> ep_at' x s
 2. \<And>s s' ko ko' x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s\<rbrakk> \<Longrightarrow> \<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)
 3. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 4. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; ko_at' ko_ thread s_; cslift s'_ (tcb_ptr_to_ctcb_ptr thread) = Some ko'_; ctcb_relation ko_ ko'_; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko_)) s_; case tcbState ko_ of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s_ | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s_ | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s_ | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko_) s_; tcbDomain ko_ \<le> maxDomain; tcbPriority ko_ \<le> maxPriority; tcbMCP ko_ \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x_ xa_)) thread s_\<rbrakk> \<Longrightarrow> ep_at' x_ s_ proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s\<rbrakk> \<Longrightarrow> \<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)
 2. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' x xa ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)
 2. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (4 subgoals):
 1. \<And>s s' ko ko' x xa ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s\<rbrakk> \<Longrightarrow> remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s
 2. \<And>s s' ko ko' x xa ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s\<rbrakk> \<Longrightarrow> remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 3. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 4. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; ko_at' ko_ thread s_; cslift s'_ (tcb_ptr_to_ctcb_ptr thread) = Some ko'_; ctcb_relation ko_ ko'_; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko_)) s_; case tcbState ko_ of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s_ | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s_ | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s_ | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko_) s_; tcbDomain ko_ \<le> maxDomain; tcbPriority ko_ \<le> maxPriority; tcbMCP ko_ \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x_ xa_)) thread s_\<rbrakk> \<Longrightarrow> remove1 thread (epQueue ep_) = [] \<longrightarrow> ko_at' ep_ x_ s_ \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x_) thread s_ \<and> valid_queues' s_ \<and> weak_sch_act_wf (ksSchedulerAction s_) s_ \<and> Invariants_H.valid_queues s_ \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s_ (a, b))) \<and> sch_act_not thread s_ \<and> valid_objs' s_ \<and> valid_ep' Structures_H.endpoint.IdleEP s_ proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' x xa ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s\<rbrakk> \<Longrightarrow> remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 2. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' x xa ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s; remove1 thread (epQueue ep) \<noteq> []; ko_at' ep x s\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 2. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' x xa ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s; remove1 thread (epQueue ep) \<noteq> []; ko_at' ep x s; thread \<in> set (epQueue ep) \<and> isRecvEP ep\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 2. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' x xa ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x xa)) thread s; remove1 thread (epQueue ep) \<noteq> []; ko_at' ep x s; thread \<in> set (epQueue ep) \<and> isRecvEP ep; valid_ep' ep s\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 2. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; ko_at' ko_ thread s_; cslift s'_ (tcb_ptr_to_ctcb_ptr thread) = Some ko'_; ctcb_relation ko_ ko'_; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko_)) s_; case tcbState ko_ of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s_ | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s_ | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s_ | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko_) s_; tcbDomain ko_ \<le> maxDomain; tcbPriority ko_ \<le> maxPriority; tcbMCP ko_ \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnReceive x_ xa_)) thread s_; remove1 thread (epQueue ep_) \<noteq> []; ko_at' ep_ x_ s_; thread \<in> set (epQueue ep_) \<and> isRecvEP ep_; valid_ep' ep_ s_\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x_) thread s_ \<and> valid_queues' s_ \<and> weak_sch_act_wf (ksSchedulerAction s_) s_ \<and> Invariants_H.valid_queues s_ \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s_ (a, b))) \<and> sch_act_not thread s_ \<and> valid_objs' s_ \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep_)) ep_) s_ proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> awaiting_reply' ts \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. None) tcb)) \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko thread s \<and> inQ d p (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ d p ko \<longrightarrow> thread \<in> set (ksReadyQueues s (d, p)))
 2. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)))
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> \<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification x)) thread s
 2. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' ts. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) ts) thread s\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' x xa xb xc xd. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s\<rbrakk> \<Longrightarrow> ep_at' x s \<and> (\<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s))
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' x xa xb xc xd. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s\<rbrakk> \<Longrightarrow> ep_at' x s
 2. \<And>s s' ko ko' x xa xb xc xd. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s\<rbrakk> \<Longrightarrow> \<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; ko_at' ko_ thread s_; cslift s'_ (tcb_ptr_to_ctcb_ptr thread) = Some ko'_; ctcb_relation ko_ ko'_; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko_)) s_; case tcbState ko_ of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s_ | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s_ | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s_ | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko_) s_; tcbDomain ko_ \<le> maxDomain; tcbPriority ko_ \<le> maxPriority; tcbMCP ko_ \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x_ xa_ xb_ xc_ xd_)) thread s_\<rbrakk> \<Longrightarrow> ep_at' x_ s_ proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' x xa xb xc xd. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s\<rbrakk> \<Longrightarrow> \<forall>ep. (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' x xa xb xc xd ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s) \<and> (remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s)
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (3 subgoals):
 1. \<And>s s' ko ko' x xa xb xc xd ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s\<rbrakk> \<Longrightarrow> remove1 thread (epQueue ep) = [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s
 2. \<And>s s' ko ko' x xa xb xc xd ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s\<rbrakk> \<Longrightarrow> remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 3. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; ko_at' ko_ thread s_; cslift s'_ (tcb_ptr_to_ctcb_ptr thread) = Some ko'_; ctcb_relation ko_ ko'_; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko_)) s_; case tcbState ko_ of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s_ | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s_ | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s_ | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko_) s_; tcbDomain ko_ \<le> maxDomain; tcbPriority ko_ \<le> maxPriority; tcbMCP ko_ \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x_ xa_ xb_ xc_ xd_)) thread s_\<rbrakk> \<Longrightarrow> remove1 thread (epQueue ep_) = [] \<longrightarrow> ko_at' ep_ x_ s_ \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x_) thread s_ \<and> valid_queues' s_ \<and> weak_sch_act_wf (ksSchedulerAction s_) s_ \<and> Invariants_H.valid_queues s_ \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s_ (a, b))) \<and> sch_act_not thread s_ \<and> valid_objs' s_ \<and> valid_ep' Structures_H.endpoint.IdleEP s_ proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' x xa xb xc xd ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s\<rbrakk> \<Longrightarrow> remove1 thread (epQueue ep) \<noteq> [] \<longrightarrow> ko_at' ep x s \<longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' x xa xb xc xd ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s; remove1 thread (epQueue ep) \<noteq> []; ko_at' ep x s\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' x xa xb xc xd ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s; remove1 thread (epQueue ep) \<noteq> []; ko_at' ep x s; thread \<in> set (epQueue ep) \<and> isSendEP ep\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' x xa xb xc xd ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)) thread s; remove1 thread (epQueue ep) \<noteq> []; ko_at' ep x s; thread \<in> set (epQueue ep) \<and> isSendEP ep; valid_ep' ep s\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x) thread s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not thread s \<and> valid_objs' s \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep)) ep) s
 2. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; ko_at' ko_ thread s_; cslift s'_ (tcb_ptr_to_ctcb_ptr thread) = Some ko'_; ctcb_relation ko_ ko'_; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko_)) s_; case tcbState ko_ of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s_ | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s_ | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s_ | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko_) s_; tcbDomain ko_ \<le> maxDomain; tcbPriority ko_ \<le> maxPriority; tcbMCP ko_ \<le> maxPriority; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnSend x_ xa_ xb_ xc_ xd_)) thread s_; remove1 thread (epQueue ep_) \<noteq> []; ko_at' ep_ x_ s_; thread \<in> set (epQueue ep_) \<and> isSendEP ep_; valid_ep' ep_ s_\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = x_) thread s_ \<and> valid_queues' s_ \<and> weak_sch_act_wf (ksSchedulerAction s_) s_ \<and> Invariants_H.valid_queues s_ \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s_ (a, b))) \<and> sch_act_not thread s_ \<and> valid_objs' s_ \<and> valid_ep' (epQueue_update (\<lambda>_. remove1 thread (epQueue ep_)) ep_) s_ proof (prove)
goal (1 subgoal):
 1. \<And>s s' ko ko'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority\<rbrakk> \<Longrightarrow> \<forall>ts. cthread_state_relation ts (tcbState_C ko', tcbFault_C ko') \<longrightarrow> (\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> (\<forall>x. (\<exists>xa. ts = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. ts = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> (\<forall>x. (\<exists>xa xb xc xd. ts = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> (\<exists>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr x)))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = blockingObject_CL (thread_state_lift (tcbState_C ko'))) \<longrightarrow> blockingObject_CL (thread_state_lift (tcbState_C ko')) = x) \<and> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal (1 subgoal):
 1. \<And>s s' ko ko' ts t. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ko thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ko'; ctcb_relation ko ko'; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF ko)) s; case tcbState ko of Structures_H.thread_state.BlockedOnReceive ref a \<Rightarrow> ep_at' ref s | Structures_H.thread_state.BlockedOnNotification ref \<Rightarrow> ntfn_at' ref s | Structures_H.thread_state.BlockedOnSend ref a b d c \<Rightarrow> ep_at' ref s | _ \<Rightarrow> True; is_aligned (tcbIPCBuffer ko) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification ko) s; tcbDomain ko \<le> maxDomain; tcbPriority ko \<le> maxPriority; tcbMCP ko \<le> maxPriority; cthread_state_relation_lifted ts (thread_state_lift (tcbState_C ko'), seL4_Fault_lift (tcbFault_C ko')); ret__unsigned_' t = tsType_CL (thread_state_lift (tcbState_C ko'))\<rbrakk> \<Longrightarrow> tsType_CL (thread_state_lift (tcbState_C ko')) = thread_state_to_tsType ts proof (prove)
goal:
No subgoals!